Before deploymentSecurity

Checklist: Container security review

16 items ·7 critical ·8 warn ·1 info

How to use

Run this checklist on every container image before it ships to production. Items in critical severity must be addressed; the build should fail CI if any are missing.

For Compose-based stacks, run the checks against the resolved container state after docker compose up.

Why these checks

The critical items address the most likely paths to a container-compromise incident:

Non-root, capabilities dropped, no-new-privileges, no socket mount. Limits the blast radius of a vulnerability inside the container.
Pinned digest, signed image, clean scan. Ensures the image is what we say it is and has no known critical CVEs.
No secrets in env. Stops credential leakage through docker inspect, ps, and child processes.

The warn items are best-practice discipline: not blocking, but the production baseline assumes them.

Critical7 items

Container runs as non-root (UID >= 1000 or USER directive set).
```
docker run --rm IMAGE id
```

All capabilities dropped except those explicitly required.

docker inspect CONTAINER --format "{{json .HostConfig.CapDrop}}" && docker inspect CONTAINER --format "{{json .HostConfig.CapAdd}}"

`security-opt: [no-new-privileges:true]` set.

docker inspect CONTAINER --format "{{json .HostConfig.SecurityOpt}}"

Container is not privileged.

docker inspect CONTAINER --format "{{.HostConfig.Privileged}}"

Docker socket is not mounted in the container.

docker inspect CONTAINER --format "{{json .Mounts}}" | grep docker.sock || echo OK

Latest Trivy / Grype scan shows no CRITICAL or HIGH CVEs.
```
trivy image --severity HIGH,CRITICAL --exit-code 1 IMAGE
```

No secrets in environment variables; secrets mounted as files.

docker inspect CONTAINER --format "{{json .Config.Env}}" | grep -i password || echo OK

Warning8 items

Root filesystem read-only where possible; tmpfs mounted for /tmp and any required writes.
```
docker inspect CONTAINER --format "{{.HostConfig.ReadonlyRootfs}}"
```
Image is pulled by digest, not tag, in production deployments.
```
grep -E "image:.*@sha256:" compose.yml
```
Image signature is verified before deploy (cosign / Sigstore).

Container attached only to the networks it needs.

docker inspect CONTAINER --format "{{json .NetworkSettings.Networks}}"

Memory and CPU limits set.

docker inspect CONTAINER --format "{{json .HostConfig.Memory}}"

PIDs limit set (not unlimited).

docker inspect CONTAINER --format "{{.HostConfig.PidsLimit}}"

Logging driver configured; rotation enabled.
Healthcheck defined and validated against the application.

Info1 item

SBOM generated and stored.