Docker Foundations·Ship the environment with the app

Production containers

Small images, least privilege and scanning reduce the blast radius.

Beginner 15 min read Lesson 10 of 300 Challenge included

What you will be able to do

Use a distroless or Alpine runtime and pin versions.
Set --read-only, --cap-drop ALL and a non-root user where supported.
Scan images in CI and rebuild base images on a schedule.

In plain English

Production containers should run as non-root, read-only where possible and with a minimal image. Do not mount the Docker socket into an application. Scan images for known vulnerabilities and set resource limits.

run.shTerminal

docker run --rm \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 256m \
  --publish 3000:3000 \
  my-app:1.0

Your turn

Harden a run command

Medium

Run an app read-only with all capabilities dropped and no-new-privileges.

BASH · starter

docker run my-app:1.0

Check your understanding before moving on.

Knowledge checkQuestion 1

Why avoid mounting /var/run/docker.sock into an app container?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Drill 1: Summarise — Installing and your first container

Lesson 10 of 300 · 0% of course