container-securitylisted

# Container Security Patterns ## Dockerfile Hardening ```dockerfile # Use minimal base image FROM python:3.12-slim AS base # Run as non-root user RUN groupadd -r appgroup && useradd -r -g appgroup appuser WORKDIR /app # Copy and install dependencies first (cache layer) COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt # Copy application code COPY --chown=appuser:appgroup . . # Drop to non-root USER appuser # Read-only filesystem — mount writable volumes explicitly # docker run --read-only --tmpfs /tmp myimage # No new privileges # docker run --security-opt=no-new-privileges myimage EXPOSE 8080 ENTRYPOINT ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"] ``` ```dockerfile # Multi-stage build — no build tools in final image FROM golang:1.22 AS builder WORKDIR /build COPY go.mod go.sum ./ RUN go mod download COPY . . RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o server ./cmd/server FROM scratch # Minimal — just the binary COPY --from=builder /build/server /server COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ USER 65534:65534 # nobody ENTRYPOINT ["/server"] ``` ## Image Scanning ```bash # Trivy — comprehensive scanner brew install trivy # Scan image trivy image python:3.12-slim trivy image --severity HIGH,CRITICAL myapp:latest # Scan and fail CI on HIGH+ trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest # Scan filesystem/repo trivy fs --scanners vuln,secret,misconfig .