Docker

Create container from rootfs

tar --verbose --create --file <file name>.tar --directory <path to rootfs> .
cat <file name>.tar | sudo docker import - <image name>

tar -C <path to rootfs> -c . | docker import - <image name>

FROM scratch
ADD <path to rootfs> /

Systemd in container

docker <> --volume /sys/fs/cgroup:/sys/fs/cgroup:rw --cgroupns=host --priveleged --command (/usr)/sbin/init

Remove all images

docker stop $(docker ps -a -q)
docker rm $(docker ps -a -q)
docker rmi $(docker images -q -f dangling=true)

Host config path

/var/lib/docker/containers//hostconfig.json

Commands

docker build --tag <image name> <path to rootfs>

docker run --rm  --name container_name  -p 80:80 -v path_in_host:path_in_container tag/name:tag

docker build -t tag/name:tag -f DockerFile .

docker exec -it container_name bash

Security

Security Options

--security-opt=no-new-privileges
--read-only

Linux Capabilities

Fine-grained privilege control by adding or dropping individual capabilities.

--cap-drop=ALL --cap-add=NET_BIND_SERVICE

View container capabilities:

docker inspect <container name> --format '{{.State.Pid}}'
cat /proc/<PID>/status | grep Cap
capsh --decode=$(grep CapEff /proc/<PID>/status | awk '{print $2}')

Seccomp

Seccomp (secure computing mode) filters allowed system calls. Default Docker profiles block ~50 dangerous syscalls.

Use unconfined when a container requires blocked syscalls (e.g. systemd containers, debugging, or legacy software):

--security-opt seccomp=unconfined

Pass a custom profile for fine-grained control:

--security-opt seccomp=/path/to/custom-profile.json

User & Privilege Drop

gosu

gosu

Tools

Crane - tool for Docker containers orchestration written in Go.
Kaniko - build Container Images.

Cache

Optimize cache usage in builds

Start scripts

Execute commands and start more one process in container

#!/usr/bin/env bash

_term() {
  echo "Caught SIGTERM signal!"
  <commands>
}

trap _term SIGTERM

<commands>

sleep infinity &

wait $!

Build images

Example