Container Security: Hardening Docker and Kubernetes Workloads in Practice

1. Run as a non-root user

The most impactful single change in container security:

# Bad: runs as root by default
FROM node:20
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]

# Good: runs as non-root user
FROM node:20-alpine

# Create a non-root user and group
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

WORKDIR /app

# Copy with correct ownership
COPY --chown=appuser:appgroup . .
RUN npm ci --production

# Switch to non-root before running
USER appuser

CMD ["node", "server.js"]

2. Use minimal base images

# Instead of full OS images (ubuntu, debian, centos)
# Use minimal alternatives:

# Alpine Linux (~5MB, musl libc)
FROM node:20-alpine

# Distroless: no shell, no package manager, minimal attack surface
FROM gcr.io/distroless/nodejs20-debian12

# Chainguard images: hardened, frequently updated
FROM cgr.dev/chainguard/node:latest

Distroless images do not contain a shell: an attacker who compromises the container cannot run arbitrary commands because no shell binary exists.

3. Multi-stage builds: avoid build tools in production images

# Stage 1: Build
FROM node:20 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Stage 2: Production: only copy the compiled output
FROM node:20-alpine AS production
RUN addgroup -g 1001 -S app && adduser -u 1001 -S app -G app
WORKDIR /app
COPY --from=builder --chown=app:app /app/dist ./dist
COPY --from=builder --chown=app:app /app/node_modules ./node_modules
USER app
CMD ["node", "dist/server.js"]

The production image contains only compiled code and runtime dependencies: not the build toolchain, not source code, not test dependencies.

4. Scan images for vulnerabilities

# Trivy: open source, integrates with CI/CD
trivy image myapp:latest

# Set a severity threshold that fails the build
trivy image --exit-code 1 --severity CRITICAL,HIGH myapp:latest

# Scan a Dockerfile for misconfigurations (non-root, no COPY --chown, etc.)
trivy config ./Dockerfile

# Grype (Anchore): alternative scanner
grype myapp:latest

# Snyk: commercial option with free tier
snyk container test myapp:latest

Never use --privileged mode:

# Bad: disables all container isolation
docker run --privileged myapp:latest

# Good: drop capabilities, add only what is needed
docker run \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid \
  myapp:latest

What these flags do:

• --cap-drop ALL: Removes all Linux capabilities (file ownership changes, raw sockets, kernel modules, etc.)
• --cap-add NET_BIND_SERVICE: Adds back only the capability to bind to ports below 1024 (only if needed)
• --security-opt no-new-privileges:true: Prevents privilege escalation via setuid binaries
• --read-only: Mounts the container filesystem as read-only: attackers cannot write payloads to disk
• --tmpfs /tmp: Provides a writable /tmp in RAM only, without exec permission

Linux capability reference for common application needs:

# Net binding (port < 1024): NET_BIND_SERVICE
# File operations: nothing extra (regular file ownership operations work)
# Network raw sockets (ping): NET_RAW
# Setting system clock: SYS_TIME
# Everything else: drop it

# List capabilities a running container is using
capsh --print  # Run inside the container

User namespace remapping (daemon-level protection):

// /etc/docker/daemon.json
{
  "userns-remap": "default",
  "no-new-privileges": true,
  "live-restore": true,
  "icc": false  // Disable inter-container communication by default
}

userns-remap maps the container's root (UID 0) to an unprivileged host UID: even if a container escape occurs, the attacker lands as an unprivileged user on the host.

Pod security context: apply to all workloads:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
spec:
  template:
    spec:
      # Pod-level security context
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      
      containers:
      - name: webapp
        image: myapp:1.2.3  # Pinned to digest, not :latest
        
        # Container-level security context
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
            add: []  # Add only what is absolutely needed
        
        # Resource limits: prevents noisy-neighbor DoS
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "500m"
        
        volumeMounts:
        - name: tmp-dir
          mountPath: /tmp
      
      volumes:
      - name: tmp-dir
        emptyDir: {}  # Writable scratch space when readOnlyRootFilesystem is true
      
      automountServiceAccountToken: false  # Disable if not using Kubernetes API

RBAC least privilege: avoid ClusterAdmin:

# Bad: full cluster access
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: myapp-admin
subjects:
- kind: ServiceAccount
  name: myapp
roleRef:
  kind: ClusterRole
  name: cluster-admin  # Never grant this to application service accounts
  apiGroup: rbac.authorization.k8s.io

# Good: namespace-scoped, specific resources only
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myapp-role
  namespace: production
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
  resourceNames: ["myapp-config"]  # Only this specific ConfigMap
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
  resourceNames: ["myapp-secret"]

Kubernetes Network Policy: default-deny:

# Default deny all ingress and egress for a namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to all pods in namespace
  policyTypes:
  - Ingress
  - Egress
---
# Allow specific ingress from the ingress controller
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-webapp-ingress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: webapp
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-nginx
    ports:
    - protocol: TCP
      port: 3000

Use Kyverno or OPA Gatekeeper to enforce policies at admission:

# Kyverno policy: require non-root in all pods
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-runAsNonRoot
    match:
      any:
      - resources:
          kinds: [Pod]
    validate:
      message: "Pods must run as non-root user"
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true
---
# Disallow privileged containers
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-privileged
    match:
      any:
      - resources:
          kinds: [Pod]
    validate:
      message: "Privileged containers are not allowed"
      pattern:
        spec:
          containers:
          - =(securityContext):
              =(privileged): false

Scan Kubernetes manifests for misconfigurations:

# Trivy: scan all YAML manifests in a directory
trivy config ./k8s/

# Checkov: infrastructure-as-code security scanner
checkov -d ./k8s/ --framework kubernetes

# kube-bench: checks against CIS Kubernetes Benchmark
# Run on the cluster itself
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job.batch/kube-bench