Containers are not magically secure. Vulnerable base images, root user, secrets in env vars — common mistakes.
Image scanning¶
Container Security — Trivy, Falco¶
trivy image myapp:latest trivy image –severity HIGH,CRITICAL nginx:latest
Secure Dockerfile¶
FROM node:20-alpine AS build WORKDIR /app COPY package*.json ./ RUN npm ci –only=production FROM gcr.io/distroless/nodejs20 COPY –from=build /app /app USER nonroot EXPOSE 3000 CMD [“app/server.js”]
Runtime security — Falco¶
Falco rule — detect shell in container¶
- rule: Shell in container condition: container and proc.name in (bash, sh, zsh) output: “Shell started in container (user=%user.name container=%container.name)” priority: WARNING
Key Takeaway¶
Distroless/alpine images, non-root user, multi-stage builds. Scan images, monitor runtime.
securitydockercontainerstrivyfalco