Hardened read-only container

Immutable rootfs, writable /tmp only, block privilege escalation; container hardening

docker run --read-only --tmpfs /tmp --security-opt no-new-privileges --cap-drop ALL <name>
tool
docker46 commands
tags
dockersecuritykernel

More docker commands

  • Watch for OOM kills
    docker events --filter event=oom --filter type=container

    Stream live OOM events to catch memory-limited containers being killed

  • Multi-platform build and push
    docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .

    Cross-compile and push directly to registry with BuildKit

  • Run container with env file
    docker run --rm -it --env-file .env -p 8000:8000 img:tag

    Local run with env vars from file; --rm auto-removes on exit

  • Inspect image layers
    docker history --no-trunc img:tag

    See each layer, its command, and size; identify bloat

  • Prune everything unused
    docker system prune -af --volumes

    Remove stopped containers, unused images, networks, volumes

all 46 docker commands