Ravindra BagaleCourses & study guides मराठी

Chapter 55: Docker Security Best Practices, Image Scanning with Trivy, Logging, Monitoring and Docker Swarm Basics

By Last updated:

A container runs, but is it safe? Today: non-root users, dropped capabilities, read-only filesystems, secrets, Trivy scans, signing, logs, monitoring and Docker Swarm. Remember one rule: least privilege, least software, and never a secret inside an image.

What you will learn in this chapter

  • Non-root and capabilities
  • Read-only filesystem and limits
  • Secrets at build and run time
  • Trivy and Docker Scout scanning
  • Signing and distroless
  • Logging drivers
  • Monitoring with cAdvisor and Prometheus
  • Swarm basics
  • Swarm stacks with secrets and configs
  • Docker contexts over SSH for remote deploys

All Docker commands in one place

Every docker command step by step on one running example (build, run, exec, logs, volumes, networks, Compose, cleanup) with a cheat sheet: All Docker Commands Step by Step with Examples

Concepts in this chapter

  1. 55.1Run containers as non-root and drop capabilities
  2. 55.2Read-only filesystem, tmpfs and resource limits
  3. 55.3Secrets: never bake passwords into images
  4. 55.4Scan images: Trivy and Docker Scout
  5. 55.5Content trust, image signing and distroless bases
  6. 55.6Logging drivers and central logs
  7. 55.7Monitoring: docker stats, cAdvisor, Prometheus and Grafana
  8. 55.8Docker Swarm basics: init, services, scaling, rolling updates
  9. 55.9Swarm stacks: secrets, configs and docker stack deploy
  10. 55.10Docker contexts: control remote Docker over SSH

The chapter recap is at the end of the last concept page.

Ravi Sir's Cards: 21 revision, interview and comparison cards for this chapter · मराठी cards