Overview
This is the reference for the workshop and for the discussion afterward. It is written for a mixed room: if you have never run a container, read it straight through, since the terms are defined as they come up and there is a glossary at the end. If you use Docker every day, skim the definitions and go to the commands.
The goal is not to hand you a list of flags to copy. It is to explain what a container actually is—not a small virtual machine, but ordinary processes running on the host’s own kernel, limited by namespaces, cgroups, and capabilities—so that each hardening step makes sense as a consequence of how the system works.
From there it works through starting from a safe base image, adding your code without leaking anything, running with the fewest privileges that still work, two things to never do (--privileged and mounting /var/run/docker.sock), and cutting an image down to what it actually uses. It closes with a checklist, a cheat sheet, and a glossary.