DEV Community: Andrew

Container Security: Hardening Your Docker & Kubernetes

Andrew — Tue, 03 Feb 2026 18:31:59 +0000

Container Security Best Practices 🔐

Image Security

Scan for Vulnerabilities

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image myapp:latest

# Critical vulnerabilities found

Use Distroless Images

FROM python:3.11 AS builder
COPY requirements.txt .
RUN pip install -r requirements.txt

FROM gcr.io/distroless/python3-nonroot
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY app.py /app.py
ENTRYPOINT ["python", "/app.py"]

Sign Images

cosign sign --key cosign.key myapp:latest
cosign verify --key cosign.pub myapp:latest

Kubernetes Pod Security

SecurityContext

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
          - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

Pod Security Standards

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'

Network Security

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-netpol
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            name: production
      ports:
      - protocol: TCP
        port: 8080
  egress:
    - to:
      - namespaceSelector:
          matchLabels:
            name: production
      ports:
      - protocol: TCP
        port: 5432

Runtime Security

AppArmor/SELinux

# Check AppArmor status
aa-status

# Load profile
apparmor_parser /etc/apparmor.d/docker-profile

Resource Limits

resources:
  requests:
    memory: "64Mi"
    cpu: "250m"
  limits:
    memory: "128Mi"
    cpu: "500m"

Supply Chain Security

✅ Signed images
✅ Verified base images
✅ SBOMs (Software Bill of Materials)
✅ Attestations
✅ Image provenance

Security Checklist

✅ No root container
✅ Image scanned for vulnerabilities
✅ Secrets not in image
✅ Read-only filesystem
✅ Capabilities dropped
✅ Network policies enforced
✅ Resource limits set
✅ Pod security policies in place

Docker Best Practices for Production Deployments

Andrew — Tue, 03 Feb 2026 01:18:42 +0000

Docker Best Practices for Production 🐳

Multi-Stage Builds: Cut Image Size by 70%

FROM node:18 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:18-alpine
COPY --from=builder /app/node_modules ./node_modules
COPY . .
USER node
EXPOSE 3000
CMD ["node", "app.js"]

Result: 900MB → 120MB image size

Security Hardening

Run as Non-Root

RUN useradd -m appuser
USER appuser

Remove Package Manager

RUN apt-get purge -y --auto-remove apt-get

Scan for Vulnerabilities

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image myapp:latest

Performance Optimization

Layer Caching - Order commands from least to most frequently changed
Use .dockerignore - Exclude unnecessary files
Minimize Layers - Combine RUN commands with &&

# Bad: 3 layers
RUN apt-get update
RUN apt-get install curl
RUN rm -rf /var/lib/apt/lists/*

# Good: 1 layer
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*

Container Networking

Health Checks

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

Port Exposure

EXPOSE 3000 8080

Production Checklist

✅ Non-root user
✅ Security scanning passed
✅ Health checks defined
✅ Resource limits set
✅ Logging configured
✅ No secrets in image

Master these practices and your deployments will be rock solid. 🚀

CKAD Daily Study Notes - 2026-02-03

Andrew — Tue, 03 Feb 2026 00:35:51 +0000

CKAD Daily Study Notes 📚

Todays Focus: Core API Objects

Pod Design Patterns

StatefulSet vs Deployment: When to use each
InitContainers: Setup tasks before app container
Multi-container pods: Design patterns and use cases

Essential Commands

# Pod creation and inspection
kubectl run nginx --image=nginx --port=80
kubectl get pods -o wide
kubectl describe pod <pod-name>
kubectl exec -it <pod> -- /bin/bash
kubectl logs <pod>

# Deployment management
kubectl create deployment web --image=nginx --replicas=3
kubectl set image deployment/web nginx=nginx:1.20
kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout undo deployment/web

Quiz Yourself

What happens when you delete a Pod in a Deployment?
How do you force a deployment rollout?
What's the difference between ReadinessProbe and LivenessProbe?
How do you mount a ConfigMap as a volume?

Exam Strategy

2 hours for 19 questions = ~6 min per question
Use imperative commands when possible (faster than YAML)
Master kubectl shortcuts:

  alias k=kubectl
  export do="--dry-run=client -o yaml"
  k run pod1 --image=nginx $do > pod.yaml

Today's Goal

Practice 5 Pod-related scenarios
Time yourself on each
Review failures

You've got this! Keep grinding. 💪

AI & Tech News Briefing - 2026-02-03

Andrew — Tue, 03 Feb 2026 00:35:43 +0000

AI & Tech News Briefing ☀️

CKAD Exam: The Essential Cheatsheet I Wish I Had When I Started

Andrew — Sat, 31 Jan 2026 17:19:21 +0000

Why I Made This Cheatsheet

Studying for the CKAD (Certified Kubernetes Application Developer) exam, I found myself constantly jumping between docs looking for the same kubectl commands and YAML templates.

So I compiled everything into one quick-reference cheatsheet. Sharing the key parts here — hopefully it saves you some time.

First Things First: Exam Setup

Run these immediately when your exam starts:

alias k=kubectl
alias kn='kubectl config set-context --current --namespace'
export do='--dry-run=client -o yaml'
export now='--force --grace-period=0'

These save massive time. Instead of typing kubectl 200 times, you type k.

Generate YAML Instantly

Don't write YAML from scratch. Generate it:

# Pod
k run nginx --image=nginx $do > pod.yaml

# Deployment
k create deployment nginx --image=nginx --replicas=3 $do > deploy.yaml

# Service
k expose deployment nginx --port=80 $do > svc.yaml

# Job
k create job my-job --image=busybox $do > job.yaml

# CronJob
k create cronjob my-cron --image=busybox --schedule="*/5 * * * *" $do > cron.yaml

Then edit the YAML as needed. Way faster than writing from memory.

Quick Resource Templates

Pod with Resource Limits

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: nginx
    resources:
      requests:
        memory: "64Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "200m"

ConfigMap Usage

spec:
  containers:
  - name: app
    envFrom:
    - configMapRef:
        name: my-config
    volumeMounts:
    - name: config-vol
      mountPath: /etc/config
  volumes:
  - name: config-vol
    configMap:
      name: my-config

Probes (Know All Three!)

spec:
  containers:
  - name: app
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 15
      periodSeconds: 10
    readinessProbe:
      tcpSocket:
        port: 8080
      initialDelaySeconds: 5
    startupProbe:
      exec:
        command: ["cat", "/tmp/healthy"]
      failureThreshold: 30

Must-Know Commands

Task	Command
Switch context	`k config use-context <name>`
Set namespace	`k config set-context --current --namespace=<ns>`
Get all resources	`k get all -A`
Describe resource	`k describe pod <name>`
Logs	`k logs <pod> -c <container>`
Exec into pod	`k exec -it <pod> -- /bin/sh`
Delete fast	`k delete pod <name> $now`
Scale	`k scale deployment <name> --replicas=5`
Rollback	`k rollout undo deployment/<name>`

Exam Tips

Always check the context — each question specifies one
Use imperative commands — faster than writing YAML
Use kubectl explain — k explain pod.spec.containers
Don't get stuck — flag and move on
Bookmark the kubectl cheatsheet in your exam browser

Full Cheatsheet

I put together a complete 15+ page PDF covering all 5 exam domains:

Application Design & Build
Application Deployment
Observability & Maintenance
Environment, Config & Security
Services & Networking

👉 Get the full CKAD Cheatsheet here

What Helped You?

If you've passed CKAD, what resources made the difference? Drop a comment — always looking to improve my prep!

Good luck to everyone studying. You got this! 🚀

DEV Community: Andrew

Container Security: Hardening Your Docker & Kubernetes

Container Security Best Practices 🔐

Image Security

Scan for Vulnerabilities

Use Distroless Images

Sign Images

Kubernetes Pod Security

SecurityContext

Pod Security Standards

Network Security

Network Policies

Runtime Security

AppArmor/SELinux

Resource Limits

Supply Chain Security

Security Checklist

Docker Best Practices for Production Deployments

Docker Best Practices for Production 🐳

Multi-Stage Builds: Cut Image Size by 70%

Security Hardening

Run as Non-Root

Remove Package Manager

Scan for Vulnerabilities

Performance Optimization

Container Networking

Health Checks

Port Exposure

Production Checklist

CKAD Daily Study Notes - 2026-02-03

CKAD Daily Study Notes 📚

Todays Focus: Core API Objects

Pod Design Patterns

Essential Commands

Quiz Yourself

Exam Strategy

Today's Goal

AI & Tech News Briefing - 2026-02-03

AI & Tech News Briefing ☀️

Top Stories This Week

LLM Breakthroughs

Kubernetes & Cloud Native

Enterprise AI

Developer Tools

Market Trends 2026

CKAD Exam: The Essential Cheatsheet I Wish I Had When I Started

Why I Made This Cheatsheet

First Things First: Exam Setup

Generate YAML Instantly

Quick Resource Templates

Pod with Resource Limits

ConfigMap Usage

Probes (Know All Three!)

Must-Know Commands

Exam Tips

Full Cheatsheet

What Helped You?