Ravindra BagaleCourses & study guides मराठी

Ravi Sir's Cards › DevOps

Chapter 55: Docker Security Best Practices, Image Scanning with Trivy, Logging, Monitoring and Docker Swarm Basics: Cards

मराठी cards · Open the chapter

Revision cards

Non-root and capabilities. Root in a container is close to root on the host if it escapes.
Revision card 1 of 8: Non-root and capabilities · Download PNG · Open card page

Lesson: 55.1 Run containers as non-root and drop capabilities

Read-only filesystem and limits. If nothing can be written, malware cannot stay.
Revision card 2 of 8: Read-only filesystem and limits · Download PNG · Open card page

Lesson: 55.2 Read-only filesystem, tmpfs and resource limits

Handling secrets safely. Leaked secrets in images are a top breach cause.
Revision card 3 of 8: Handling secrets safely · Download PNG · Open card page

Lesson: 55.3 Secrets: never bake passwords into images

Scan images with Trivy and Docker Scout. Old packages carry known vulnerabilities (CVEs).
Revision card 4 of 8: Scan images with Trivy and Docker Scout · Download PNG · Open card page

Lesson: 55.4 Scan images: Trivy and Docker Scout

Signing and minimal images. You must know an image is really yours and unchanged.
Revision card 5 of 8: Signing and minimal images · Download PNG · Open card page

Lesson: 55.5 Content trust, image signing and distroless bases

Central logging for containers. SSH into 50 servers to read logs does not scale.
Revision card 6 of 8: Central logging for containers · Download PNG · Open card page

Lesson: 55.6 Logging drivers and central logs

Monitoring containers. You must see trouble before users do.
Revision card 7 of 8: Monitoring containers · Download PNG · Open card page

Lesson: 55.7 Monitoring: docker stats, cAdvisor, Prometheus and Grafana

Docker Swarm basics. One host is a single point of failure.
Revision card 8 of 8: Docker Swarm basics · Download PNG · Open card page

Lesson: 55.8 Docker Swarm basics: init, services, scaling, rolling updates

Interview cards

What are Linux capabilities in Docker? Root's powers split into pieces (NET_ADMIN, SYS_ADMIN...). Docker gives a default set; --cap-drop ALL and add back only what is needed.
Interview card 1 of 8: What are Linux capabilities in Docker? · Download PNG · Open card page

Lesson: 55.1 Run containers as non-root and drop capabilities

How do you make a container read-only but still working? Add --read-only and give writable tmpfs or volumes only where the app writes (/tmp, cache, uploads).
Interview card 2 of 8: How do you make a container read-only but still working? · Download PNG · Open card page

Lesson: 55.2 Read-only filesystem, tmpfs and resource limits

Where should container secrets come from? A secret store (Secrets Manager, Vault) or mounted secret files, not image layers or plain env vars that show in inspect.
Interview card 3 of 8: Where should container secrets come from? · Download PNG · Open card page

Lesson: 55.3 Secrets: never bake passwords into images

How do you stop vulnerable images reaching production? Scan in the pipeline with Trivy or Scout and --exit-code 1 on HIGH/CRITICAL; also enable ECR scanning.
Interview card 4 of 8: How do you stop vulnerable images reaching production? · Download PNG · Open card page

Lesson: 55.4 Scan images: Trivy and Docker Scout

Why sign container images? To prove the image came from your pipeline and was not changed. Deploy checks reject unsigned images.
Interview card 5 of 8: Why sign container images? · Download PNG · Open card page

Lesson: 55.5 Content trust, image signing and distroless bases

How do containers send logs to CloudWatch? Use the awslogs driver with awslogs-group and awslogs-region; the host needs an IAM role allowing logs:PutLogEvents.
Interview card 6 of 8: How do containers send logs to CloudWatch? · Download PNG · Open card page

Lesson: 55.6 Logging drivers and central logs

How do you monitor containers in production? cAdvisor or node-exporter on each host, scraped by Prometheus, shown in Grafana, with alerts for memory, restarts and health.
Interview card 7 of 8: How do you monitor containers in production? · Download PNG · Open card page

Lesson: 55.7 Monitoring: docker stats, cAdvisor, Prometheus and Grafana

Swarm vs Kubernetes? Swarm: built in, simple, small teams. Kubernetes: far bigger ecosystem and the industry standard for large platforms.
Interview card 8 of 8: Swarm vs Kubernetes? · Download PNG · Open card page

Lesson: 55.8 Docker Swarm basics: init, services, scaling, rolling updates

Comparison cards

Trivy vs Docker Scout. Trivy: open-source scanner by Aqua.Scout: Docker's built-in analysis.
Comparison card 1 of 3: Trivy vs Docker Scout · Download PNG · Open card page

Lesson: 55.4 Scan images: Trivy and Docker Scout

Swarm vs Kubernetes. Swarm: built into Docker.Kubernetes: separate orchestration platform.
Comparison card 2 of 3: Swarm vs Kubernetes · Download PNG · Open card page

Lesson: 55.8 Docker Swarm basics: init, services, scaling, rolling updates

Env variable vs Secret file. Env var: value in the environment.Secret file: value mounted at /run/secrets.
Comparison card 3 of 3: Env variable vs Secret file · Download PNG · Open card page

Lesson: 55.3 Secrets: never bake passwords into images