| Solid post though there are a couple of things I would disagree with: > Do not upgrade your system packages Most distros will have smooth upgrades and provide you with patched libs that your app may need and the latest image may not provide. It's slightly more prone to breaks but it creates a less vulnerable runtime app env. > Do not use ‘latest’ tag for base image Depends on the org but sometimes pinning means that you will likely end up using and end-of-life image because it requires proactive work to maintain. If you leave it as 'latest' this won't happen but you will get out-of-band breaks to keep that working. Choose wisely. A few things I would add too: - Don't mount Docker socket into any container unless absolutely necessary - Your biggest security threat will be from your app's dependencies, not the container's setup - Do not run a full init system unless absolutely necessary as this is just a security disaster waiting to happen. There are valid use cases for it but they're rare. |