Ngamanake Docker melibatke pirang-pirang layer — minimal lan trusted images, nglampahi minangka non-root, vulnerability scanning, secrets management, resource lan capability limits, lan host/daemon hardening. Container security penting amarga vulnerabilities bisa mengaruhi container lan host.
✓ Use MINIMAL base images (alpine, distroless) → fewer packages = smaller attack surface
✓ Use TRUSTED/official images; pin specific versions/DIGESTS (not "latest")
✓ SCAN images for vulnerabilities (Trivy, docker scout, Snyk) — in CI and regularly
✓ Keep base images UPDATED (patch known CVEs)
✓ Don't include secrets or unnecessary tools in images
✓ Run as NON-ROOT (USER instruction) — a root container that's compromised is far more
dangerous (especially with host access). This is one of the most important practices.
✓ Drop capabilities (--cap-drop ALL, add only needed ones) — limit what the container can do
✓ Read-only filesystem (--read-only) where possible
✓ no-new-privileges (prevent privilege escalation)
✓ Set RESOURCE LIMITS (prevent DoS from resource exhaustion)
✓ NEVER run --privileged unless absolutely necessary (it gives near-host access)
✓ Don't bake secrets into images; use secrets management at runtime
✓ Protect the DOCKER DAEMON — the daemon runs as root; access to it = root on the host
(don't expose the Docker socket; mounting /var/run/docker.sock into a container is risky)
✓ Keep the host and Docker engine PATCHED; use minimal/hardened host OS
✓ Isolate networks; limit container-to-container and container-to-host access
✓ Consider rootless Docker / user namespaces for stronger isolation
Ngamanake Docker containers penting minangka senior-level knowledge amarga container vulnerabilities bisa mengaruhi host, ndadekake security minangka multi-layered concern karo real consequences. Image security practices (minimal/trusted base images kanggo ngurangi attack surface, pinning versions, scanning for vulnerabilities kanggo nangkep known CVEs, njaga images tetep updated) nyegah ngirim exploitable images — sumber umum vulnerabilities. Runtime security terumalik critical: nglampahi minangka non-root minangka siji saka most important practices amarga compromised root container luwih bahaya (potentially nglampahi host compromise), lan dropping capabilities, nggunakake read-only filesystems, nyegah privilege escalation, lan nunggal nunggal ndunungake --privileged kejaba absolutely necessary (iku grant near-host access) kabeh mbatesi apa attacker bisa nindakake yen container breached — defense in depth. Secrets management (nunggal nunggal baking secrets menyang images, nggunakake runtime secrets) nyegah credential leaks. Host lan daemon security crucial lan sering overlooked: Docker daemon nglampahi minangka root, mula access menyang iku (utawa Docker socket) effectively ateges root on the host — ndadekake protecting daemon, ndunungake Docker socket, lan njaga host patched essential, karo rootless Docker lan user namespaces nawisake stronger isolation.
\nAmarga containers share host kernel (mula container escape utawa host compromise duwe serious consequences) lan containerized applications pervasive ing production, lan amarga proper security (minimal/scanned images, non-root runtime karo limited capabilities, secrets management, lan daemon/host hardening) minangka apa nyegah real container lan host compromises, ngerti piye cara ngamanake Docker containers penting senior-level knowledge — critical responsibility kanggo production container deployments, ngendi layered practices (terumalik non-root execution lan protecting root-privileged daemon) address genuine, serious security risks inherent menyang containerization.