Container Security
Secure Docker containers for production deployments.
Base Image Selectionโ
# Use minimal, non-root images
FROM node:20-alpine AS runtime
RUN addgroup -g 1001 gauzy && adduser -u 1001 -G gauzy -s /bin/sh -D gauzy
USER gauzy
Security Hardeningโ
Read-Only Filesystemโ
securityContext:
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1001
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
Resource Limitsโ
resources:
limits:
cpu: "2"
memory: "2Gi"
requests:
cpu: "500m"
memory: "512Mi"
Image Scanningโ
# Scan with Trivy
trivy image ghcr.io/ever-co/gauzy-api:latest
# Scan with Docker Scout
docker scout cves ghcr.io/ever-co/gauzy-api:latest
Best Practicesโ
| Practice | Description |
|---|---|
| Multi-stage builds | Minimize image size |
| .dockerignore | Exclude secrets, dev files |
| No root | Run as non-root user |
| Pin versions | Use exact image tags |
| Scan regularly | CI/CD vulnerability scanning |
| Limit capabilities | Drop ALL, add only needed |
| Read-only FS | Prevent runtime file writes |
| Health checks | Container-level health probes |
Related Pagesโ
- Docker Multi-Stage Optimization โ build optimization
- Kubernetes Deployment โ K8s
- Vulnerability Scanning โ scanning