Module 13 Lesson 4: Production Security Checklist

Moving from "My Laptop" to "The Internet" is a massive jump in risk. Use this checklist as your final audit before you hit the "Deploy" button.

The Production Top 10

1. [ ] User: Is the USER instruction set to a non-root user? (Module 7).
2. [ ] Base Image: Are you using a specific, minimal version (e.g., :alpine) instead of :latest?
3. [ ] Secrets: Are passwords and keys removed from the Dockerfile and passed via Docker Secrets or a secure Vault? (Module 7).
4. [ ] Scanning: Has the image been scanned for critical CVEs in the last 24 hours? (Module 7).
5. [ ] Networking: Are your databases on a private, internal network? (Module 10).
6. [ ] Resource Limits: Does the container have memory and CPU limits to prevent DoS? (Module 4).
7. [ ] Healthchecks: Is there a HEALTHCHECK defined to detect zombie processes? (Module 6).
8. [ ] Logs: Is log rotation enabled to prevent disk exhaustion? (Module 13).
9. [ ] Read-Only: Can you run the container with a read-only root filesystem? (--read-only).
10. [ ] Update Policy: Is your orchestrator set to perform rolling updates to avoid downtime? (Module 12).

---

2. The "CIS Benchmark"

For high-security industries (Finance, Healthcare), there is an official "CIS Docker Benchmark." It is a 200-page document detailing every possible hardening step. You don't need to read it all—tools like Docker Bench for Security can run these checks for you automatically.

docker run --rm -it \
  --net host --pid host --userns host --cap-add audit_control \
  -v /etc:/etc:ro -v /usr/bin/docker:/usr/bin/docker:ro \
  -v /var/lib/docker:/var/lib/docker:ro \
  docker/docker-bench-security

---

3. Monitoring Your Security

Security isn't a "Done" state; it's a process.

• Static Analysis: Scan images during build.
• Runtime Analysis: Monitor for unusual behavior (e.g., a web server suddenly trying to run an ssh command) using tools like Falco.

---

Exercise: The Security Audit

1. Choose a project you've built during this course.
2. Go through the Top 10 checklist above. How many "Checks" do you pass?
3. Identify the #1 biggest security risk in that project (e.g., "running as root").
4. Fix that one risk right now.
5. Why is "Security" often the first thing developers skip, and what are the consequences of that choice?

---

Summary

This checklist is your "Guardrail." By following these 10 steps, you eliminate 99% of the common mistakes that lead to hacked servers and data breaches. You are now a responsible, security-minded Docker engineer.

Next Lesson: Looking ahead: Future trends: Docker, Podman, and beyond.