Summary
In this chapter, we have reviewed some basic steps you can take to ensure that when you pull images and build and run containers, your attack surface will be reduced.
We learned about how to ensure that we only pull safe images from Docker Hub. Additionally, we saw how we can use read-only permissions to prevent write access to filesystems.
Multi-stage builds were discussed to show how we can break down our container build process into steps to ensure that SSH keys and similar are not accidentally included in the final product. The .dockerignore file was briefly reviewed from a security perspective, and finally, we discussed how to restrict system resources and implement access control through removing capabilities.
In the next chapter, we will look at how we can automate some of the security processes by using scanning tools and implement monitoring.
