Docker
You're viewing a free preview. Sign in free to read every script.
Why this exists A container's default settings are chosen for convenience, not safety: it runs as root inside the container, keeps a dozen Linux capabilities, can write anywhere in its filesystem, can start as many…
Hardened docker run Profile: Non-Root, Read-Only, No Capabilities, Limits, and Proof That Each Setting Bites
A run-hardened.sh wrapper that starts containers with restrictive defaults (non-root user, read-only filesystem, no capabilities, no new privileges, PID and memory limits, no network) and real experiments showing what each one prevents, from a fork bomb contained at 50 processes to an out-of-memory kill and a blocked namespace escape.
Sign in free to read this script, along with the rest of the library.
Sign in free