A comprehensive reference for deploying containers securely. Use this as a checklist before every production release — no single measure is sufficient; defense in depth wins.

1. The Hardening Philosophy

Defense in depth means adding independent layers of security so that if one fails, the others still protect you. For containers, that means hardening the image, the runtime, the network, and the orchestrator — not just one layer.

2. Image Hardening

• Use minimal base image (distroless / alpine / scratch)
• Pin base image by digest (FROM image@sha256:…)
• No secrets in image — use BuildKit --mount=type=secret
• Scan for vulnerabilities; fail CI on critical findings
• Generate and attach SBOM (Software Bill of Materials)
• Sign image with Cosign and enforce policy
• Rebuild regularly to pick up base image patches

3. Runtime Hardening

• Run as non-root — USER 10001 (numeric UID)
• Read-only root filesystem — --read-only
• Drop all capabilities, add only needed — --cap-drop=ALL --cap-add=NET_BIND_SERVICE
• Enable --security-opt no-new-privileges
• Set memory and CPU limits — --memory --cpus
• Set PID limit — --pids-limit 100 (prevents fork bombs)
• Use custom seccomp profile if possible
• Mount sensitive paths as read-only (:ro bind mounts)

4. Network Hardening

• Use user-defined networks (not default bridge)
• Don't expose ports unless needed — no -p 0.0.0.0:…
• Apply network policies to restrict inter-service traffic
• Enable mTLS between services (or use a service mesh)
• No --net=host in production unless strictly required

5. Operational Hardening

• Health checks defined (HEALTHCHECK in Dockerfile)
• Restart policy set — on-failure:5 (not always)
• Logs to stdout — captured by log driver, not written to container FS
• Resource limits prevent noisy-neighbor problem
• Graceful shutdown — trap SIGTERM, drain connections, exit cleanly
• Immutable deployments — never patch a running container; redeploy

6. Orchestrator-Level Hardening

• Pod Security Standards enforced (Restricted profile)
• Admission control — only signed images from approved registries
• RBAC configured — least privilege for service accounts
• Network policies applied per namespace
• Secrets encrypted at rest in etcd

7. The Quick Audit

The Fully-Hardened docker run Command

Every flag earns its place. Know why each one is there:

Verify with docker inspect

# Check user
docker inspect myapp | jq '.[0].Config.User'
# → "10001:10001"

# Check capabilities
docker inspect myapp | jq '.[0].HostConfig.CapDrop, .[0].HostConfig.CapAdd'
# → ["ALL"]  ["NET_BIND_SERVICE"]

# Check read-only FS
docker inspect myapp | jq '.[0].HostConfig.ReadonlyRootfs'
# → true

# Check resource limits
docker inspect myapp | jq '{mem: .[0].HostConfig.Memory, cpus: .[0].HostConfig.NanoCpus}'
# → {"mem": 268435456, "cpus": 500000000}

# Check PID limit
docker inspect myapp | jq '.[0].HostConfig.PidsLimit'
# → 100

Fully-Hardened Kubernetes PodSpec

apiVersion: v1
kind: Pod
metadata:
  name: hardened-app
  annotations:
    # Cosign admission webhook verifies image signature
    policy.sigstore.dev/include: "true"
spec:
  automountServiceAccountToken: false   # no K8s API access unless needed
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault               # kernel syscall filter
  containers:
    - name: app
      image: myregistry.io/myapp@sha256:abc123...
      securityContext:
        allowPrivilegeEscalation: false  # no-new-privileges equivalent
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
          add:  ["NET_BIND_SERVICE"]
      resources:
        requests: { cpu: "100m", memory: "128Mi" }
        limits:   { cpu: "500m", memory: "256Mi" }
      livenessProbe:
        httpGet: { path: /healthz, port: 8080 }
        initialDelaySeconds: 5
        periodSeconds: 10
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir: { medium: Memory, sizeLimit: 64Mi }

Knowledge Check

Hands-On: Harden an Unhardened Container

docker run -d --name insecure-nginx -p 80:80 nginx:latest

docker inspect insecure-nginx | jq '
  .[0] | {
    user:     .Config.User,
    readonly: .HostConfig.ReadonlyRootfs,
    capdrop:  .HostConfig.CapDrop,
    capadd:   .HostConfig.CapAdd,
    memory:   .HostConfig.Memory,
    pids:     .HostConfig.PidsLimit
  }'
# user: ""  ← running as root!
# readonly: false  ← writable FS
# capdrop: null  ← no caps dropped

docker network create --driver bridge hardened-net

docker run -d --name hardened-nginx \
  --user 101:101 \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=32m \
  --tmpfs /var/cache/nginx:rw,noexec,nosuid \
  --tmpfs /var/run:rw,noexec,nosuid \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --cap-add CHOWN \
  --security-opt no-new-privileges \
  --memory 128m --memory-swap 128m \
  --cpus 0.25 \
  --pids-limit 50 \
  --network hardened-net \
  --restart on-failure:3 \
  -p 127.0.0.1:8080:80 \
  nginx:alpine

# All checks should return expected hardened values
docker inspect hardened-nginx | jq '
  .[0] | {
    user:     .Config.User,
    readonly: .HostConfig.ReadonlyRootfs,
    capdrop:  .HostConfig.CapDrop,
    capadd:   .HostConfig.CapAdd,
    memory:   .HostConfig.Memory,
    pids:     .HostConfig.PidsLimit,
    newnoprivs: .HostConfig.SecurityOpt
  }'

curl http://127.0.0.1:8080/
# → Welcome to nginx!

Industry Standards & Regulated Environments

docker run --rm -it \
  --net host --pid host --userns host --cap-add audit_control \
  -v /var/lib:/var/lib -v /var/run/docker.sock:/var/run/docker.sock \
  docker/docker-bench-security