32. Docker Security Fundamentals

1# Create user
2RUN addgroup --system app && adduser --system --group app
3
4# Set ownership
5RUN chown -R app:app /app
6
7# Switch to non-root
8USER app
9
10CMD ["rails", "server"]

1services:
2  web:
3    read_only: true
4    tmpfs:
5      - /tmp
6      - /app/tmp

1# Scan image for vulnerabilities
2docker scout quickview myapp:latest
3docker scout cves myapp:latest
4
5# Using Trivy
6trivy image myapp:latest

1# Docker secrets (Swarm)
2services:
3  web:
4    secrets:
5      - db_password
6
7secrets:
8  db_password:
9    file: ./secrets/db_password.txt