Docker Security
summary
Five-round comparison: VMs win isolation and track record, containers win attack surface, controls and auditing, resulting in a draw. Concrete advice: use a non-root user inside images and prefer gosu for privilege drop, set the container filesystem read-only and mount only needed writable volumes, drop unnecessary Linux capabilities and set memory limits (-m) to avoid OOM issues, use Docker diff to detect file changes, and store secrets in Vault or Keywhiz via volume plugins rather than baking them into images or env vars.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:15ISOLATION GUARANTEES
- 4:19ATTACK SURFACE
- 6:09CONTROLS
- 7:47AUDITING
- 10:26TRACK RECORD
- 22:05TURN OFF INTER-CONTAINER COMMUNICATION
- 23:20SHARING SECRETS
related talks
35mDocker Security
14mDocker Security
26mThe 10 Container Security Tricks That (...)
47mContainer Security, Are You Doing It Wrong?
14mYour Containers Aren’t Alone: Demystifying Container Isolation
34mHow secure are Docker containers?
31mYour Containers Aren’t Alone: Demystifying Container Isolation
30mMaster the Container Security Model with