Back
Syntax
Study
Editor
Mode:
HTML
CSS
JavaScript
PHP
Reset
Run »
HTML / CSS / JS
# Resource-limited, security-hardened container docker run -d \ --name api \ --memory 256m \ --memory-swap 256m \ --cpus 0.5 \ --read-only \ --tmpfs /tmp:size=64m \ --cap-drop ALL \ --cap-add NET_BIND_SERVICE \ --security-opt no-new-privileges \ --user 1001:1001 \ -p 3000:3000 \ myapp:2.1.0 # Check applied limits docker inspect api --format '{{.HostConfig.Memory}}' docker inspect api --format '{{.HostConfig.NanoCpus}}' # Verify read-only filesystem docker inspect api --format '{{.HostConfig.ReadonlyRootfs}}' # Scan image for CVEs docker scout cves myapp:2.1.0 # Check if image runs as root (empty = root = bad) docker inspect myapp:2.1.0 --format '{{.Config.User}}' # trivy scan (open-source alternative) # trivy image myapp:2.1.0
Result
Open