Hardening & Confinement

Rootless daemons cannot bind ports below 1024, need cgroup v2 with systemd delegation for resource limits, and route traffic through a userspace network stack that costs throughput. Fix with the unprivileged-port sysctl, Delegate=yes, and a suitable port driver or host proxy.

Rotate the credential first — treat it as compromised. Layers are immutable and content-addressed, so a later deletion only hides the file, and squashing produces a new digest while the old one stays pullable from the registry, mirrors, caches and node image stores until it is deleted and garbage-collected.

It blunts abuses of in-container root against the host: writing root-owned bind-mounted files, host device access, host-privileged kernel operations. It does not stop kernel exploits, a mounted daemon socket, or container-to-container access, and it is incompatible with host PID/network sharing and privileged mode.

Work out the host-side UID: remap offset plus the in-container UID (165536 + 10001 = 175537), then chown the host directory to it. Named volumes avoid this because Docker seeds their ownership from the image.

A rebuild produces new bytes, so unless application inputs are pinned the base refresh smuggles in unreviewed upgrades. Make the base the only floating input, gate on each service's tests, stagger the rollout, and remember rebuilding is not deploying.

Baseline: drop all capabilities, no-new-privileges, runtime default seccomp, MAC profile on, read-only root filesystem, no privileged and no host namespaces. Roll out in audit/permissive mode first, fix the failures found, then enforce. Exceptions get a named owner, a scope, and an expiry.

Grant the minimum, not the superset: expose only the specific device and the few capabilities the workload needs, never blanket --privileged. Then assume breakout is possible and shrink what a breakout reaches -- a dedicated low-trust host or node pool, no other tenants or secrets, a minimal cloud identity, network segmentation, and a patched runtime.

Treat them as host-resource protection, not per-service tuning. Measure peak task and descriptor use across the estate, define two or three tiers rather than per-service numbers, set the tier as the platform default, and make a higher tier an explicit, reviewed choice.

Rootful Docker centralizes root in one long-lived daemon and socket. Rootless Docker keeps the daemon but confines it to a user. Podman drops the daemon entirely: containers are children of the invoking user, so identity and audit follow the human. Decide on isolation, auditability and feature needs.

A multi-platform tag resolves to an index listing one manifest per architecture. Pinning the index digest keeps every platform buildable; pinning one architecture's manifest digest hard-codes that architecture, and a build requested for another platform finds no matching entry.

--device /dev/ttyUSB0:/dev/ttyUSB0:rwm creates that one node inside the container and adds a matching allow rule to its device cgroup. The trailing letters mean read, write and mknod; drop letters to narrow the grant, for example :r for read-only access.

All three do the same core job: inventory image components and match versions against CVE feeds, output findings, and can produce/consume SBOMs. Choice comes down to coverage breadth, integration (Trivy also scans IaC/secrets/misconfig; Scout integrates with Docker Hub/Desktop and shows remediation; Grype pairs with Syft), false-positive behaviour, licensing/cost, and where it runs (CLI/CI/registry).

A tmpfs mount is memory-backed: nothing written there reaches the container's writable layer or the host disk, and it vanishes when the container stops. Compose and Swarm secrets mount each value read-only at /run/secrets/<name> — Compose from a local file, Swarm from the encrypted raft store over mutual TLS.

They are mandatory access control systems that restrict which objects a process may touch, regardless of Unix permissions. AppArmor is path-based (Docker applies a docker-default profile); SELinux is label-based, giving each container a distinct MCS category. Denials appear in the host's kernel log, not as application errors.

Both are escapes in runc, the low-level binary Docker uses to start containers. CVE-2019-5736 let a malicious container overwrite the host runc binary via /proc/self/exe and gain root on the next exec. CVE-2024-21626 (Leaky Vessels) used a leaked host file descriptor plus a crafted WORKDIR to break out to the host filesystem, at build or run time.