intermediateContainer Security: Non-Root, Secrets, Image Scanning & Distroless

What Linux capabilities-related hardening would you apply to a production container?

Drop all default Linux capabilities with --cap-drop=ALL, then add back only the specific capabilities the application genuinely requires (e.g., NET_BIND_SERVICE if it needs to bind a privileged port below 1024). Combine this with --security-opt=no-new-privileges to prevent setuid binaries from escalating privileges inside the container, even if such a binary exists in the image.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to A security audit flags that database credentials are visible via `docker inspect` on production hosts →← Back to all Docker questions