Docker

Commands

Create container from rootfs

tar --verbose --create --file <file name>.tar --directory <path to rootfs> .
cat <file name>.tar | sudo docker import - <image name>

tar -C <path to rootfs> -c . | docker import - <image name>

FROM scratch
ADD <path to rootfs> /

Systemd in container

docker <> --volume /sys/fs/cgroup:/sys/fs/cgroup:rw --cgroupns=host --priveleged --command (/usr)/sbin/init

Remove all images

docker stop $(docker ps -a -q)
docker rm $(docker ps -a -q)
docker rmi $(docker images -q -f dangling=true)

Show size of layers

docker history --human --format '{{.Size}}\t{{.CreatedBy}}' <image>

Security

Security Options

--security-opt=no-new-privileges
--read-only

Linux Capabilities

Fine-grained privilege control by adding or dropping individual capabilities.

--cap-drop=ALL --cap-add=NET_BIND_SERVICE

View container capabilities:

docker inspect <container name> --format '{{.State.Pid}}'
cat /proc/<PID>/status | grep Cap
capsh --decode=$(grep CapEff /proc/<PID>/status | awk '{print $2}')

Seccomp

Seccomp (secure computing mode) filters allowed system calls. Default Docker profiles block ~50 dangerous syscalls.

Use unconfined when a container requires blocked syscalls (e.g. systemd containers, debugging, or legacy software):

--security-opt seccomp=unconfined

Pass a custom profile for fine-grained control:

--security-opt seccomp=/path/to/custom-profile.json

User & Privilege Drop

gosu

gosu

Tools

Crane - tool for building and managing container images, written in Go.
BuildKit - tool for building container images, written in Go.
Buildah - tool for building OCI/Docker container images without a daemon, written in Go.

Cache

Optimize cache usage in builds

Configs

Host config path

/var/lib/docker/containers//hostconfig.json

Start scripts

Execute commands and start more one process in container

#!/usr/bin/env bash

_term() {
  echo "Caught SIGTERM signal!"
  <commands>
}

trap _term SIGTERM

<commands>

sleep infinity &

wait $!

Build images

Example

Dockerfile

Here-Documents

RUN <<'EOF'
  <commands>
EOF

COPY <<'EOF' <file name>
  <text>
EOF

COPY <<-EOT <file name>.sh
  "${<variable>}"
EOT
```
````dockerfile
COPY <<-"EOT" <file name>.sh
  echo "${<variable>}"
EOT
```