container-hardening

# Container Hardening ## Base Image Selection - Use a **Universal Base Image (UBI)** from the official [Red Hat Container Registry](https://catalog.redhat.com/software/containers/search) - Prefer **ubi-minimal** (`ubi8/ubi-minimal` or `ubi9/ubi-minimal`) to reduce attack surface - Use the most up-to-date image available ### Image Tagging Strategy | Source | Strategy | |---|---| | **Red Hat Catalog** | Omit floating tags to get the latest image; exception: Konflux project uses digest-based pinning with automated updates | | **Non-Red Hat registries** | Pin the version or digest to ensure you use the intended image and not a tampered one | ## Minimize Installed Software Remove non-essential packages and clean up package manager caches: ```dockerfile RUN microdnf upgrade -y && \ microdnf install -y <required-packages> && \ microdnf remove -y <unnecessary-packages> && \ microdnf clean all ``` Use `microdnf` on ubi-minimal images; `dnf` on full UBI images. ## Runtime Security ### Privilege Restrictions Set `no-new-privileges` to prevent privilege escalation during container execution: ```yaml securityContext: allowPrivilegeEscalation: false ``` Or in a compose file: ```yaml security_opt: - no-new-privileges: true ``` ### Read-Only Filesystem Use read-only root filesystems wherever possible: ```yaml securityContext: readOnlyRootFilesystem: true ``` Mount writable `tmpfs` volumes only where the application requires write access (e.g., `/tmp`, `/va...