# Container Security {#container-security}


Secure Docker containers for production deployments.


## Base Image Selection {#base-image-selection}


```dockerfile
# Use minimal, non-root images
FROM node:20-alpine AS runtime
RUN addgroup -g 1001 gauzy && adduser -u 1001 -G gauzy -s /bin/sh -D gauzy
USER gauzy
```


## Security Hardening {#security-hardening}



### Read-Only Filesystem {#read-only-filesystem}


```yaml
securityContext:
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1001
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
```


### Resource Limits {#resource-limits}


```yaml
resources:
  limits:
    cpu: "2"
    memory: "2Gi"
  requests:
    cpu: "500m"
    memory: "512Mi"
```


## Image Scanning {#image-scanning}


```bash
# Scan with Trivy
trivy image ghcr.io/ever-co/gauzy-api:latest

# Scan with Docker Scout
docker scout cves ghcr.io/ever-co/gauzy-api:latest
```


## Best Practices {#best-practices}


| Practice           | Description                   |
| ------------------ | ----------------------------- |
| Multi-stage builds | Minimize image size           |
| .dockerignore      | Exclude secrets, dev files    |
| No root            | Run as non-root user          |
| Pin versions       | Use exact image tags          |
| Scan regularly     | CI/CD vulnerability scanning  |
| Limit capabilities | Drop ALL, add only needed     |
| Read-only FS       | Prevent runtime file writes   |
| Health checks      | Container-level health probes |


## Related Pages {#related-pages}


- [Docker Multi-Stage Optimization](https://sourcey-gauzy.pages.dev/devops/docker-optimization/index.md) — build optimization
- [Kubernetes Deployment](https://sourcey-gauzy.pages.dev/deployment/kubernetes/index.md) — K8s
- [Vulnerability Scanning](https://sourcey-gauzy.pages.dev/security/vulnerability-scanning/index.md) — scanning