Improve docker container security

How to improve container security

• Avoid root in container. Create an unprivileged user in container, e.g. with --user 1000:1000 or with a custom /etc/passwd file.
• Drop all capabilities with --cap-drop ALL.
  • Add only those capabilities your application needs indeed (if any) with e.g. --cap-add CHOWN.
  • Avoid capabilitiy SYS_ADMIN that would allow root-like powers.
  • Compare man capabilities and docker documentation about capabilities.
• Forbid gaining privileges in container (e.g. with su) with option --security-opt no-new-privileges.
• Mount container root file system read-only and only allow rw access for /tmp with --read-only --tmpfs /tmp.
• Do NOT use --privileged. If you want to give access to specific devices, use e.g. --device /dev/snd.