Security hardening

Q: How deeply does Learn Docker in a Month of Lunches, Second Edition cover security hardening?

Works through image and configuration scans, then stops short of automatic fixes by requiring pragmatic review and end-to-end testing.

As explained in Learn Docker in a Month of Lunches, Second Edition

Security hardening is the practice of reducing exploitable weaknesses by applying restrictive configuration and removing unnecessary capabilities.

Security hardening reduces exploitable weaknesses by restricting configuration and removing unnecessary capabilities. In container workflows, inspect both image contents and deployment artifacts, then balance each fix against application compatibility. section 17.2

A practical hardening workflow includes:

Scan Dockerfiles, Kubernetes manifests, Helm charts, and infrastructure-as-code files for misconfiguration. section 17.2
Prefer non-root containers and read-only filesystems when the application supports them, then verify the change with end-to-end tests. section 17.2

Try it now

Run Trivy against a repository with the misconfiguration scanner and restrict results to high- and critical-severity findings. Investigate each result before changing the deployment configuration.

How Learn Docker in a Month of Lunches, Second Edition covers it

Cover of Learn Docker in a Month of Lunches, Second Edition

liveBook manning.com

Read Learn Docker in a Month of Lunches, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Secure APIsServer hardening is the practice of reducing a server's attack surface by disabling unnecessary services, restricting access, and applying restrictive security configurations.

Compare how 2 books explain security hardening →

Related concepts

vulnerabilityaddresses · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
attack surfaceaddresses · An attack surface is the set of exposed or reachable interfaces, components, capabilities, and pathways through which an attacker could access or affect a system.
SQL Server instanceconfigures · A SQL Server instance is an independently configured and running installation of SQL Server that hosts databases, provides database services, and accepts connections.
principle of least privilegeuses · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
monitoringuses · Monitoring is the ongoing observation and measurement of a system’s behavior, state, or operational signals to assess its condition and detect changes or problems.
change managementuses · Change management is the structured process of planning, evaluating, coordinating, implementing, and reviewing changes to organizations, systems, processes, or practices.

This explainer was generated by Manning's knowledge graph from the text of Learn Docker in a Month of Lunches, Second Edition. The section links point to the parts of the book it draws on.