From 9e96f9ccd9fcc83eb6f4bc776645d27558dec71a Mon Sep 17 00:00:00 2001 From: Liran Tal Date: Tue, 12 Mar 2019 11:32:22 +0200 Subject: [PATCH] docs(README): security tips for docker images best practices --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 127158d..dd92bb3 100644 --- a/README.md +++ b/README.md @@ -529,6 +529,8 @@ See the [Docker Security Cheat Sheet](https://github.com/konstruktoid/Docker/blo Check out the [docker bench security script](https://github.com/docker/docker-bench-security), download the [white papers](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/). +Snyk's [10 Docker Image Security Best Practices cheat sheet](https://snyk.io/blog/10-docker-image-security-best-practices/) + You should start off by using a kernel with unstable patches for grsecurity / pax compiled in, such as [Alpine Linux](https://en.wikipedia.org/wiki/Alpine_Linux). If you are using grsecurity in production, you should spring for [commercial support](https://grsecurity.net/business_support.php) for the [stable patches](https://grsecurity.net/announce.php), same as you would do for RedHat. It's $200 a month, which is nothing to your devops budget. Since docker 1.11 you can easily limit the number of active processes running inside a container to prevent fork bombs. This requires a linux kernel >= 4.3 with CGROUP_PIDS=y to be in the kernel configuration.