docker-safetylisted

## Baseline **Applies when:** Writing or running a `Dockerfile`/`Containerfile`, `docker-compose.yml`, `docker build`/`run`/`exec` (or podman/nerdctl/buildah equivalents), or a Kubernetes manifest setting `securityContext`, `hostNetwork`, `hostPID`, `hostIPC`, `privileged`, or `hostPath` volumes. **Always:** - Pin base images to an immutable digest (`FROM <image>@sha256:...`); floating tags (`latest`, major/minor only) are for non-deployed internal tooling only. - Declare and switch to a non-root `USER` before `CMD`/`ENTRYPOINT`; `COPY --chown=app:app` files the runtime needs to read. - Pass build-time secrets with BuildKit `--mount=type=secret`; pass runtime secrets via `--env-file` or a secret store, never baked into the image. - Run production containers with `read_only`/`--read-only`, `no-new-privileges`, and `cap_drop: [ALL]` with only required capabilities re-added. - Pin package versions, use the minimal-install flag, and clean the package cache in the same layer; verify checksums for downloaded binaries. **Never:** - `--privileged` / `privileged: true` — disables seccomp, AppArmor, and capability dropping. - `--net=host` / `network_mode: host` or `--pid=host` / `pid: host` — shares the host's network or process namespace. - `-v /:/host` or mounting `/var/run/docker.sock` into the container — full host filesystem or Docker daemon control. - `ENV`/`ARG` for secrets, or `COPY .env .` — persists secrets in image history. - `chmod -R 777` inside a container image. Open