How to harden Docker images

Using the init process is the bset way to launch multiple programs, clean up orphaned processes, monitor processes, and automatically restart any failed processes.

What need to consider when using init program in docker container:

1. Additional dependencies the program will bring into the image
2. File sizes
3. How the program passes signals to its child processes (or if it does)
4. Required user access
5. Monitoring and restart functionality.
6. Zombie process cleanup features.

A general strategy for hardening an application image is to minimize the software included with it.

Beyond the general strategy to harden image:

1. enforce your images are built from a specific image
2. have a sensible default user.
3. eliminate a common path for root user escalation

Fixed the basic image by using CAIIDs.

1. sudo docker pull debian:jessie
2. #dockerfile
FROM debian@sha256:f3acedf74ce1b8cd4d7963a366c8101e9cae7f48197c76b636e6d5a0bfada627