Docker Security Best Practices

# ❌ Running as root (default)
FROM node:20-alpine
WORKDIR /app
COPY . .
CMD ["node", "server.js"]

# ✅ Create and use a non-root user
FROM node:20-alpine

# Create a non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY --chown=appuser:appgroup . .
RUN npm ci --production

# Switch to non-root user
USER appuser

CMD ["node", "server.js"]

# ❌ Full image with unnecessary tools
FROM node:20          # ~1 GB, includes build tools

# ✅ Alpine variant
FROM node:20-alpine   # ~130 MB, minimal

# ✅✅ Distroless (even more secure)
FROM gcr.io/distroless/nodejs20  # No shell, no package manager

# Scan with Docker Scout
docker scout cves myapp:latest

# Scan with Trivy (popular open-source scanner)
trivy image myapp:latest

# Scan during CI/CD
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

# ❌ NEVER do this
ENV API_KEY=sk-1234567890
COPY .env /app/.env

# ✅ Pass secrets at runtime
# docker run -e API_KEY=sk-xxx myapp

# ✅ Use Docker secrets (Swarm) or mount secret files
# docker run -v ./secrets:/run/secrets:ro myapp

# Run with read-only root filesystem
docker run --read-only \
  --tmpfs /tmp \
  --tmpfs /var/run \
  myapp:latest

# In docker-compose.yml
services:
  api:
    image: myapp:latest
    read_only: true
    tmpfs:
      - /tmp
      - /var/run

# Drop all capabilities and add only what's needed
docker run \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  myapp:latest

# Prevent privilege escalation
docker run --security-opt=no-new-privileges myapp:latest

# docker-compose.yml
services:
  api:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 128M
    restart: unless-stopped