Hardened read-only container docker
Immutable rootfs, writable /tmp only, block privilege escalation; container hardening
docker run --read-only --tmpfs /tmp --security-opt no-new-privileges --cap-drop ALL <name>
more docker
all 46 commands →
Watch for OOM kills
docker events --filter event=oom --filter type=container
Multi-platform build and push
docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .
Run container with env file
docker run --rm -it --env-file .env -p 8000:8000 img:tag
Inspect image layers
docker history --no-trunc img:tag
Prune everything unused
docker system prune -af --volumes