Container security starts with image creation. Minimal base images reduce attack surface. Secret management prevents credential exposure. Runtime configuration limits container capabilities.
Image Security
Use minimal base images like Alpine or distroless. Pin image versions for reproducibility. Scan images for vulnerabilities. Multi-stage builds exclude build dependencies.
- Start from minimal base images
- Run as non-root users
- Scan images with tools like Trivy or Snyk
- Use multi-stage builds excluding dev dependencies
- Never embed secrets in images
Runtime Security
Run containers with minimal privileges. Use read-only filesystems where possible. Configure resource limits preventing DoS. Enable security profiles like seccomp and AppArmor.