Docker · Containers in practice
How do you harden a container at runtime?
Short answer
Run as non-root, drop capabilities, use a read-only root filesystem, enable no-new-privileges, apply seccomp, and set resource limits. Treat the container as hostile by default.
Containers share the host kernel, so runtime hardening reduces the impact of a compromised process. The goal is to give the process only the privileges it needs and to make the filesystem and kernel surface as small as possible.
docker run --user 10001:10001 --read-only --tmpfs /tmp \
--cap-drop ALL --security-opt no-new-privileges \
--security-opt seccomp=./seccomp.json --pids-limit 256 api:1.0.0Layers of hardening
- Non-root user with a fixed UID and no write access to application code
- Drop all capabilities, then add back only what is required
- no-new-privileges prevents setuid escalation
- seccomp blocks unnecessary syscalls
- Read-only root filesystem limits post-exploitation changes
- User namespaces map container root to an unprivileged host user
- A sandboxed runtime such as gVisor or Kata for untrusted code
Hardening is not free. Some applications need to bind a privileged port, write to a cache directory or use a specific syscall. Add exceptions narrowly and document them rather than disabling a control globally.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why is --privileged dangerous?
- 2What does no-new-privileges prevent?
- 3How do you handle an app that needs to bind port 80?
- 4When would you use a sandboxed runtime?
Say it in the interview
I harden containers by running as non-root, dropping all capabilities and adding back only what is needed, and enabling no-new-privileges and seccomp. I also use a read-only root filesystem with explicit writable mounts and set resource limits. When an app needs an exception, I add it narrowly rather than using privileged mode, which would undo most of the isolation.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Docker mock interview and get scored feedback on depth, clarity and confidence.