This talks gives you a slide introduction about best practices writing docker files regarding, size, maintainability and security.

1. Docker Best
Practices

2. Some basics to start with

3. Server
Host OS
Hyper Visor
GuestOS
Bins/
libs
App
A
GuestOS
Bins/
libs
App
A`
GuestOS
Bins/
libs
App
B
Server
Host OS
Docker Engine
Bins/ libs Bins/ libs
AppA
AppA`
AppA`
AppB
AppB`
AppB`
AppB`
AppB`
container
Container vs. VMs

4. As „ephemeral“ as possible

5. Single-process-per-container

6. Docker has layers

7. Base Image
Dockerfile Docker container with Layers
FROM sonarqube:7.1
Define

8. Base Image
Layer A
Dockerfile Docker container with Layers
FROM sonarqube:7.1
ENV SONARQUBE_HOME=/opt/sonarqube
Define

9. Base Image
Layer A
Layer B
Dockerfile Docker container with Layers
FROM sonarqube:7.1
ENV SONARQUBE_HOME=/opt/sonarqube
COPY plugins/branch-2.0.0.jar
$SONARQUBE_HOME/extensions
Define

10. Base Image
Layer A
Layer B
Layer C
Dockerfile Docker container with Layers
FROM sonarqube:7.1
ENV SONARQUBE_HOME=/opt/sonarqube
COPY plugins/branch-2.0.0.jar
$SONARQUBE_HOME/extensions
RUN dpkg --add-architecture i386
&& apt-get update
&& apt-get install -y file git curl zip
Define

11. Base Image
Layer A
Layer B
Layer C
docker build -t my/container:1.0 .
Build
Docker registry
Push
custom/sonar:v1.1
FROM sonarqube:7.1
ENV SONARQUBE_HOME=/opt/sonarqube
COPY plugins/branch-2.0.0.jar
$SONARQUBE_HOME/extensions
RUN dpkg --add-architecture i386
&& apt-get update
&& apt-get install -y file git curl zip
docker push my/container :1.0

13. copy to temp
Base Image
Layer A
Layer B
Layer C
Build
Docker build context
docker build -t my/container:1.0 .
Build Context Pfad
/var/lib/docker/tmp/docker-builder001817348/

14. Base Image
Layer A
Layer B
Layer C
docker build -t my/container:1.0 .
Build
FROM sonarqube:7.1
ENV SONARQUBE_HOME=/opt/sonarqube
COPY plugins/branch-2.0.0.jar
$SONARQUBE_HOME/extensions
RUN dpkg --add-architecture i386
&& apt-get update
&& apt-get install -y file git curl zip
Build Cache
cached
Build
cached
Build
Docker build cache

16. Best Practices

17. Optimize Build Time

18. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

19. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

20. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

21. copy to temp
Base Image
Layer A
Layer B
Layer C
Build
Use .dockerignore to reduce context
docker build -t my/container:1.0 . /var/lib/docker/tmp/docker-builder001817348/

22. Reduce image size

23. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

24. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

25. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

26. Maintainability

27. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

28. https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/

30. User minimal images

31. https://snyk.io/blog/10-docker-image-security-best-practices/
Use Least privileged user
Having an application on the container run with the root user further broadens
the attack surface and enables an easy path to privilege escalation if the application
itself is vulnerable to exploitation.

32. UID & GUID
Use the same UID and GUID for interacting container
Container A
user: worker (uuid 500)
group: worker (guid 500)
Container B
user: worker (uuid 600)
group: worker (guid 600)
Write Files read Files
X

33. Don’t leak sensitive information to Docker images

34. https://snyk.io/blog/10-docker-image-security-best-practices/
Using multi-stage builds when using secrets
By leveraging Docker support for multi-stage builds, fetch and manage
secrets in an intermediate image layer that is later disposed of so that no
sensitive data reaches the image build

35. https://snyk.io/blog/10-docker-image-security-best-practices/
Using Docker secret commands
Use an alpha feature in Docker for managing secrets to mount sensitive
files without caching them.

36. COPY . .
Beware of recursive copy

37. COPY VS. ADD
Use COPY instead of ADD

38. What is your best pratice?

39. Further Topics

40. Security-
Enhanced
Linux
(SELinux) … ?
https://en.wikipedia.org/wiki/Security-Enhanced_Linux#/media/File:SELinux_logo.svg

41. +
https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf
=

42. Docker
image
Scanner
Base Image
Layer A
Layer B
Layer C

43. https://res.cloudinary.com/snyk/image/upload/v1551121069/Number_of_OS_vulnerabilities_by_docker_image.png

44. Next Steps @ home
https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/
https://snyk.io/blog/10-docker-image-security-best-practices/
https://res.cloudinary.com/snyk/image/upload/v1551798390/Docker_Image_Security_Best_Practices_.pdf
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/

45. Monitoring@AWS / Architectural Draft / 2017-06-13 b 45
Thank you!