🔧 DevOps
Container Security
Secure Docker containers for production deployments.
Base Image Selection
# Use minimal, non-root images
FROM node:20-alpine AS runtime
RUN addgroup -g 1001 gauzy && adduser -u 1001 -G gauzy -s /bin/sh -D gauzy
USER gauzySecurity Hardening
Read-Only Filesystem
securityContext:
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1001
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]Resource Limits
resources:
limits:
cpu: "2"
memory: "2Gi"
requests:
cpu: "500m"
memory: "512Mi"Image Scanning
# Scan with Trivy
trivy image ghcr.io/ever-co/gauzy-api:latest
# Scan with Docker Scout
docker scout cves ghcr.io/ever-co/gauzy-api:latestBest Practices
| Practice | Description |
|---|---|
| Multi-stage builds | Minimize image size |
| .dockerignore | Exclude secrets, dev files |
| No root | Run as non-root user |
| Pin versions | Use exact image tags |
| Scan regularly | CI/CD vulnerability scanning |
| Limit capabilities | Drop ALL, add only needed |
| Read-only FS | Prevent runtime file writes |
| Health checks | Container-level health probes |
Related Pages
- Docker Multi-Stage Optimization — build optimization
- Kubernetes Deployment — K8s
- Vulnerability Scanning — scanning