# Introduction

Why talk about container security/hardening?

- Good containers improve system security

- Bad containers do the opposite

--

What about this one?

`docker run --rm -it -v /:/host ubuntu:latest`

---

## Hardening is a must nowadays

- CIS Benchmarking is a good thing to do:

  - Checkout: https://www.cisecurity.org/benchmark/docker and https://github.com/docker/docker-bench-security

- Running `docker` in a non-root environment as well.

- Consider `podman` instead of `docker`

---

## Build images as secure as possible

- Build them according to the best practices as described here <https://docs.docker.com/develop/develop-images/dockerfile_best-practices/>

- Be careful when building `base images`:

  - Due to inherentence labels are transfered from one image to the other

  - What if you are listed as maintainer?

(Not only labels are inherited btw.)

---

## What about exising container images?

- Do we rebuild them?

- Or can we change the behavior of the container without modifying the image?

--

## Yes we can

- Let's see how in the next slides where we will secure a nice demo application.
