Dockerfile Security Best Practices

Re:Dockerfile Security Best Practices by antonvs on Thursday October 15, 2020 @10:31AM (#24789004)

What about a "docker secure" command which updates the configuration to a more secure default?

This also raises the possibility of different security profiles like dev, prod, etc.

A default Docker install would be documented as being for development, and you run "docker secure" to change that for other environments.

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by cpuguy83 on Thursday October 15, 2020 @05:12PM (#24794044)

I like the general idea, but ultimately suffers the same problem in that people have to know about it. There actually is a setting to set the default bind address already.

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by antonvs on Friday October 16, 2020 @04:11PM (#24804579)

If you can't change the default because of backwards compatibility and inertia, you can at least provide a well-documented, recommended, easy way of fixing the default.

Is there official documentation that tells users to set the default bind address as a best practice?

I wasn't thinking so much of just changing one setting, but rather having a way to easily reconfigure an installation to set multiple settings to improve security.

In addition, elevating this to the status of a command and documenting it as a best practice helps spread awareness.

[ Parent | on HN ]