CONTAINER SECURITY BEST PRACTICES

INTRODUCTION

Containers have revolutionized application deployment, but they introduce unique security challenges. This guide covers essential practices for securing containerized workloads.

IMAGE SECURITY

1. USE MINIMAL BASE IMAGES

CODE_BLOCK // DOCKERFILE
# ❌ Large attack surface
FROM ubuntu:latest

# ✅ Minimal image
FROM alpine:3.18
# or
FROM gcr.io/distroless/nodejs:18

2. MULTI-STAGE BUILDS

CODE_BLOCK // DOCKERFILE
# Build stage
FROM node:18 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Runtime stage
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
USER node
CMD ["node", "server.js"]

3. SCAN IMAGES REGULARLY

CODE_BLOCK // BASH
# Scan with Trivy
trivy image myapp:latest

# Scan with Grype
grype myapp:latest

RUNTIME SECURITY

1. RUN AS NON-ROOT

CODE_BLOCK // DOCKERFILE
RUN addgroup -g 1001 appgroup && \
    adduser -D -u 1001 -G appgroup appuser
USER appuser

2. READ-ONLY FILESYSTEM

CODE_BLOCK // YAML
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: app
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

3. RESOURCE LIMITS

CODE_BLOCK // YAML
resources:
  limits:
    cpu: "1"
    memory: "512Mi"
  requests:
    cpu: "100m"
    memory: "128Mi"

NETWORK SECURITY

1. NETWORK POLICIES

CODE_BLOCK // YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

SECRETS MANAGEMENT

Never hardcode secrets:

CODE_BLOCK // YAML
# Use Kubernetes secrets
env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-credentials
      key: password

MONITORING AND LOGGING

Implement runtime security monitoring:

CODE_BLOCK // BASH
# Falco rules for suspicious activity
- rule: Unexpected Network Connection
  desc: Detect unexpected outbound connections
  condition: outbound and not allowed_destinations
  output: "Suspicious connection (user=%user.name command=%proc.cmdline)"
  priority: WARNING

CONCLUSION

Container security requires a layered approach: secure images, hardened runtime, network isolation, and continuous monitoring.