Docker Day 12: Core Security Practices – Avoid Running Images as Root

Official Docker documentation divides security into three areas: image security, runtime security, and network security.

1. Image Security

Use official images

# Official verification
docker pull docker.io/library/nginx:latest
# Equivalent to (library is default)
docker pull nginx:latest

Update base images regularly

# Scan image vulnerabilities
docker scout cves python:3.12-slim

2. Run as non‑root user

# ✅ Official recommended Dockerfile
FROM nginxinc/nginx-unprivileged:alpine3.23-perl
# Built‑in nginx user is already created
USER nginx

Manually create a user

RUN addgroup -S app && adduser -S app -G app
USER app

3. Read‑only filesystem

docker run --read-only -d nginx:alpine

Temporary file directories

docker run --read-only --tmpfs /tmp -d nginx:alpine

docker‑compose.yml example

services:
  api:
    read_only: true
    tmpfs:
      - /tmp
      - /run

4. Drop unnecessary capabilities

# Remove all capabilities, keep only network bind
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx:alpine

5. Secrets management

Do not store passwords in the image

# ❌ Dangerous
ENV DB_PASSWORD=secret123

# ✅ Use environment variables or Docker secrets

docker‑compose secrets

services:
  api:
    secrets:
      - db_password
secrets:
  db_password:
    file: ./secrets/db_password.txt

6. Security scanning tools

Docker Scout (official)

# Login
docker scout login

# Scan image
docker scout cves myapp:1.0

Trivy

brew install trivy
trivy image python:3.12-slim

7. Checklist

Use official base images

Run containers as non‑root

Enable read‑only filesystem

Update image versions regularly

Scan for vulnerabilities with Trivy or Scout

Never embed sensitive data in images; use secrets or env vars

8. Day 12 recap

Non‑root user is the first security step

Combine --read-only and --tmpfs to tighten file‑system permissions

Use docker scout cves to scan known vulnerabilities

Store sensitive information with secrets or environment variables