# 4. 🐳 Advanced Docker: Security, Networking & Optimization (Production Guide)

### 🎯 Why This Blog Matters

At senior DevOps levels, Docker is **not just about running containers** — it’s about:

* Securing images
    
* Designing container networks
    
* Optimizing performance & cost
    
* Preventing production incidents
    

---

## 🔐 Docker Security (Very Important)

### 🔹 Run Containers as Non-Root (Must)

```bash
RUN adduser -D appuser
USER appuser
```

Why?

* Prevents container escape risks
    
* Reduces blast radius
    

---

### 🔹 Avoid Secrets in Dockerfile

❌ Bad:

```bash
ENV DB_PASSWORD=admin123
```

✅ Good:

* Kubernetes Secrets
    
* Docker secrets
    
* Environment variables at runtime
    

---

### 🔹 Scan Images for Vulnerabilities

```bash
trivy image myapp:latest
```

Scan for:

* OS vulnerabilities
    
* Library CVEs
    
* Misconfigurations
    

---

### 🔹 Use Minimal & Trusted Base Images

Recommended:

* `alpine`
    
* `distroless`
    
* Official images only
    

---

## 🔹 Docker Capabilities & Security Flags

```bash
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx
```

Disable unnecessary privileges.

---

## 🔹 Docker Content Trust

```bash
export DOCKER_CONTENT_TRUST=1
```

Ensures **signed images only**.

---

## 🌐 Docker Networking (Deep Dive)

### 🔹 Bridge Network (Default)

* Containers communicate via IP
    
* NATed network
    

```bash
docker network ls
```

---

### 🔹 User-Defined Bridge (Best Practice)

```bash
docker network create mynet
docker run --network mynet nginx
```

Benefits:

* DNS-based service discovery
    
* Better isolation
    

---

### 🔹 Host Network

```bash
docker run --network host nginx
```

Pros:

* No NAT overhead  
    Cons:
    
* Port conflicts
    
* Security risks
    

---

### 🔹 Overlay Network

Used in:

* Docker Swarm
    
* Multi-host communication
    

---

### 🔹 None Network

```bash
docker run --network none busybox
```

Used for:

* Complete isolation
    
* Security testing
    

---

## 🔹 Container-to-Container Communication

```bash
docker run --name db --network mynet mysql
docker run --name app --network mynet myapp
```

Use **container names**, not IPs.

---

## ⚡ Docker Performance & Optimization

### 🔹 Limit CPU & Memory (Mandatory in Prod)

```bash
docker run --memory=512m --cpus=1 nginx
```

Prevents:

* Host resource starvation
    
* Noisy neighbor issues
    

---

### 🔹 Reduce Image Build Time

* Cache dependencies
    
* Use `.dockerignore`
    
* Combine RUN commands
    

```bash
RUN apt update && apt install -y curl && rm -rf /var/lib/apt/lists/*
```

---

### 🔹 Optimize Logging

```bash
docker logs
```

Use:

* json-file rotation
    
* Centralized logging (ELK)
    

---

## 🔹 Docker Storage Optimization

### Clean Unused Resources

```bash
docker system prune -a
```

⚠️ Use with caution in production.

---

## 🔹 Docker BuildKit (Faster Builds)

```bash
export DOCKER_BUILDKIT=1
```

Benefits:

* Parallel builds
    
* Cache mounts
    
* Secret mounts
    

---

## 🔹 Docker Compose (Advanced Usage)

```bash
services:
  app:
    image: myapp
    networks:
      - backend
  db:
    image: mysql
networks:
  backend:
```

Used for:

* Local multi-container testing
    
* Pre-Kubernetes environments
    

---

## 🔥 Real Production Incident (Story)

> **Issue:** Production host became unresponsive  
> **Root Cause:** Docker containers had no memory limits  
> **Fix:** Enforced CPU & memory limits  
> **Result:** System stability restored

---

## 🎯 Interview Takeaways

* Never run containers as root
    
* Always scan images
    
* Use user-defined bridge networks
    
* Enforce resource limits
    
* Optimize image size & builds