3 ms·
You guys are doing a great job! Some security-related sandboxing options to docker run that people may not be aware of, which are hard to assemble individually
by yid 10y ago
You guys are doing a great job! Some security-related sandboxing options to docker run that people may not be aware of, which are hard to assemble individually from Linux pieces:
* --read-only
* --security-opt="no-new-privileges"
* --cap-drop=ALL
* --net="none"
* --cpu-period=
* --cpu-quota=
- redtuesday 10y agoIs it intended that the last two have nothing after the equal sign? If yes, what does that do? There is also --pids-limit=<some number> against fork bombs. EDIT - this git repo has more links to security related articles etc. https://github.com/wsargent/docker-cheat-sheet#security https://github.com/wsargent/docker-cheat-sheet#security