Container security checklist
Controls for images, runtime, secrets, networking and the operational scan process.
Images
- Use small, maintained base images
- Reference images using immutable tags or digests
- Assess critical vulnerabilities before production
Runtime
- Avoid privileged containers
- Review read-only filesystems and minimal Linux capabilities
- Define CPU, memory and process limits
Secrets and identity
- Do not store secrets in images or Git
- Use service identities and short-lived credentials
- Protect administrative access with MFA
Operations
- Establish regular scans and clear finding owners
- Time-limit and audit exceptions
- Document remediation and rescanning
This guide is for orientation. It is not a certification, legal advice or a guarantee of compliance.