Back to Docker
🛡️
Phase 5
Production Hardening & Supply Chain
What changes when the image leaves your laptop: least privilege, resource limits, secret handling, and knowing what is actually inside what you ship.
1
Least Privilege and Resource Limits: Hardening a Container
Containers run as root by default. Drop privileges, lock the filesystem, cap resources — and understand why the Docker socket is the line reviewers watch for.
dockersecuritynon-root
2
Secrets and Configuration: Two Problems, Two Solutions
Build-time and runtime credentials leak in different ways. Learn where each one ends up, why ENV isn't as private as it looks, and what to do when one escapes.
dockersecretsbuildkit
3
Supply Chain: Scanning, SBOMs and Build Provenance
Know what's inside what you ship. Docker Scout, SBOMs, provenance attestations — and how to triage findings without chasing an impossible zero.
dockerdocker-scoutsbom