4. 🐳 Advanced Docker: Security, Networking & Optimization (Production Guide)

🎯 Why This Blog Matters

At senior DevOps levels, Docker is not just about running containers — it’s about:

• Securing images

• Designing container networks

• Optimizing performance & cost

• Preventing production incidents

---

🔐 Docker Security (Very Important)

🔹 Run Containers as Non-Root (Must)

RUN adduser -D appuser
USER appuser

Why?

• Prevents container escape risks

• Reduces blast radius

---

🔹 Avoid Secrets in Dockerfile

❌ Bad:

ENV DB_PASSWORD=admin123

✅ Good:

• Kubernetes Secrets

• Docker secrets

• Environment variables at runtime

---

🔹 Scan Images for Vulnerabilities

trivy image myapp:latest

Scan for:

• OS vulnerabilities

• Library CVEs

• Misconfigurations

---

🔹 Use Minimal & Trusted Base Images

Recommended:

• alpine

• distroless

• Official images only

---

🔹 Docker Capabilities & Security Flags

docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx

Disable unnecessary privileges.

---

🔹 Docker Content Trust

export DOCKER_CONTENT_TRUST=1

Ensures signed images only.

---

🌐 Docker Networking (Deep Dive)

🔹 Bridge Network (Default)

• Containers communicate via IP

• NATed network

docker network ls

---

🔹 User-Defined Bridge (Best Practice)

docker network create mynet
docker run --network mynet nginx

Benefits:

• DNS-based service discovery

• Better isolation

---

🔹 Host Network

docker run --network host nginx

Pros:

• No NAT overhead
  Cons:

• Port conflicts

• Security risks

---

🔹 Overlay Network

Used in:

• Docker Swarm

• Multi-host communication

---

🔹 None Network

docker run --network none busybox

Used for:

• Complete isolation

• Security testing

---

🔹 Container-to-Container Communication

docker run --name db --network mynet mysql
docker run --name app --network mynet myapp

Use container names, not IPs.

---

⚡ Docker Performance & Optimization

🔹 Limit CPU & Memory (Mandatory in Prod)

docker run --memory=512m --cpus=1 nginx

Prevents:

• Host resource starvation

• Noisy neighbor issues

---

🔹 Reduce Image Build Time

• Cache dependencies

• Use .dockerignore

• Combine RUN commands

RUN apt update && apt install -y curl && rm -rf /var/lib/apt/lists/*

---

🔹 Optimize Logging

docker logs

Use:

• json-file rotation

• Centralized logging (ELK)

---

🔹 Docker Storage Optimization

Clean Unused Resources

docker system prune -a

⚠️ Use with caution in production.

---

🔹 Docker BuildKit (Faster Builds)

export DOCKER_BUILDKIT=1

Benefits:

• Parallel builds

• Cache mounts

• Secret mounts

---

🔹 Docker Compose (Advanced Usage)

services:
  app:
    image: myapp
    networks:
      - backend
  db:
    image: mysql
networks:
  backend:

Used for:

• Local multi-container testing

• Pre-Kubernetes environments

---

🔥 Real Production Incident (Story)

Issue: Production host became unresponsive
Root Cause: Docker containers had no memory limits
Fix: Enforced CPU & memory limits
Result: System stability restored

---

🎯 Interview Takeaways

• Never run containers as root

• Always scan images

• Use user-defined bridge networks

• Enforce resource limits

• Optimize image size & builds