Docker Security Best Practices
Containers, ko, DEFAULT, RUP, se, "root" USER, ke, roop, mein, RUN, hote, HAIN — YE, RISKY, hai, kyunki, agar, container, COMPROMISE, ho, jaaye, TO, ATTACKER, ke, PAAS, root-level, ACCESS, hoga. Dockerfile, mein, "USER" instruction, se, EK, NON-ROOT, USER, SPECIFY, karna, BEST, PRACTICE, hai.
MINIMAL, BASE, IMAGES, (jaise, "alpine" ya, "distroless") use, karna, ATTACK, SURFACE, KAAFI, KAM, kar, deta, hai — JITNE, KAM, PACKAGES, IMAGE, mein, HONGE, UTNI, KAM, VULNERABILITIES, ki, POSSIBILITY, RAHEGI.
# Non-root user use karo
FROM node:20-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
WORKDIR /app
COPY --chown=appuser:appgroup . .
CMD ["node", "server.js"]
# Image vulnerabilities scan karo
docker scout cves myimage:latest
# Secrets ko env vars mein hardcode mat karo, secrets mount karo:
docker run --secret db_password myapp- USER instruction se non-root user set karna security best practice hai
- Minimal base images (alpine, distroless) attack surface kam karti hain
- Secrets ko kabhi Dockerfile/ENV mein hardcode mat karo, secret mounts use karo
"--read-only" flag, se, container, ka, ROOT, filesystem, READ-ONLY, ban, jaata hai — YE, ENSURE, karta hai, ki, agar, container, COMPROMISE, ho, bhi, jaaye, TO, ATTACKER, PERMANENT, CHANGES, (jaise, malware, install, karna) NAHI, kar, paayega.
docker run --read-only --tmpfs /tmp myapp"--cap-drop" se, container, se, UNNECESSARY, Linux, CAPABILITIES, (jaise, NET_RAW, jo, raw, sockets, banane, deta hai) HATAYI, ja, sakti, HAIN — PRINCIPLE, OF, LEAST, PRIVILEGE, follow, karte, huye.
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp