Securing the Container

A compromised container can lead to a compromised host. "Container Escape" is a real threat. Security must be baked into the image from Day 1.

1. Rootless Containers

By default, Docker processes run as Root. If a hacker escapes the container, they have root access to your server. Always use a non-root user in your Dockerfile:

RUN adduser -D myuser
USER myuser

2. Vulnerability Scanning

Containers are often built on old base images with thousands of known vulnerabilities (CVEs). Use tools like Trivy or Snyk in your CI/CD pipeline to block images that contain "Critical" security holes.

4. Interview Mastery

Q: "How do you handle Secrets (Passwords/Keys) in Docker?"

Architect Answer: "NEVER Bake them into the image using `ENV` or `ARG`. Anyone who downloads the image can see them. Instead, use **Environment Variables** injected at runtime, or better yet, a dedicated **Secrets Manager** (like Azure Key Vault) that the container fetches from upon startup using a Managed Identity."