Skip to content
SudoSecurity

Sections

beginner · hardening · 100 points · 0 working it

Hardening a Dockerfile

A container is shipping to prod running as root, pinned to :latest, and launched with --privileged. Name each fix.

  1. Drop root

    Containers default to root. USER 1001 (or a named user) confines a breakout to an unprivileged account. Checkpoint: the Dockerfile instruction — one word.

    Which Dockerfile instruction sets a non-root runtime user?

    Hint

    Four letters, all caps in the file.

    Sign in to verify this checkpoint.

  2. Kill the privileged flag

    docker run --privileged gives the container every device and capability — nearly root on the host. Checkpoint: the flag itself.

    Which docker run flag grants near-host-root access?

    Hint

    It starts with two dashes.

    Sign in to verify this checkpoint.

  3. Pin the image

    :latest is a moving target — the same tag can resolve to different bytes tomorrow. Pin by digest (image@sha256:...) so deploys are byte-identical. Checkpoint: what you pin by.

    Pin to the immutable ____ instead of a floating tag.

    Hint

    sha256:... is one of these.

    Sign in to verify this checkpoint.