10 Docker Security Best Practices

1. docker-node

   1 72 8,434 8.7 Dockerfile

   Official Docker Image for Node.js :whale: :turtle: :rocket:

   

   If you’re developing Node.js applications, you may want to consult with the official Docker and Node.js Best Practices.

2. Stream

   getstream.io featured

   Stream - Scalable APIs for Chat, Feeds, Moderation, & Video. Stream helps developers build engaging apps that scale to millions with performant and flexible Chat, Feeds, Moderation, and Video APIs and SDKs powered by a global edge network and enterprise-grade infrastructure.

   

3. cli

   2 85 5,172 9.8 TypeScript

   Snyk CLI scans and monitors your projects for security vulnerabilities. (by snyk)

   

   Therefore, one way of protecting against vulnerabilities in open source security software is to use tools such as Snyk, to add continuous docker security scanning and monitoring of vulnerabilities that may exist across all of the Docker image layers that are in use.

4. cosign

   3 35 5,064 9.5 Go

   Code signing and transparency for containers and binaries

   

   SigStore project, including its cosign tool, implements simple signing, storage, and verification of artifacts.

5. security-txt

   4 14 1,826 10.0 HTML

   A proposed standard that allows websites to define security policies.

   

   It is good practice to adopt a SECURITY.TXT (RFC5785) file that points to your responsible disclosure policy for your Docker label schema when adding labels, such as the following:

6. connaisseur

   5 4 457 8.3 Go

   An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster

   

   Another thing to consider with image signatures is how you will be running the containers. For most of us, Kubernetes is our platform of choice, and it does not have native support for DCT, so unless you are using a specific distribution that implements it, you are going to need to provide some form of runtime enforcement. Fortunately, the Kubernetes admission controller API can be leveraged to do this, and open source projects like Connaisseur can take care of this for DCT / Notary v1 as well as Cosign signatures.

7. hadolint

   6 30 11,352 8.3 Haskell

   Dockerfile linter, validate inline bash, written in Haskell

   

   One such linter is hadolint. It parses a Dockerfile and shows a warning for any errors that do not match its best practice rules.

Suggest a related project