~14 min · security, production
By default, processes inside a container run as root. If your app has a vulnerability and an attacker breaks out of the namespace, they're root on the host. Creating a system user and switching to it before CMD costs two lines and removes that escalation path.
--memory and --cpus tell the kernel how much your container is allowed. Without them, a buggy container can OOM the host, taking everything else down with it.
FROM python:3.12-slim
WORKDIR /app
# Install everything as root
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
# Create system user/group, then switch BEFORE CMD
RUN addgroup --system app && adduser --system --group app
USER app
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]# Cap memory at 512MB, swap at 1GB total
docker run -d --memory=512m --memory-swap=1g myapp
# Cap CPU at 1.5 cores
docker run -d --cpus=1.5 myapp
# Watch live
docker stats --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}'USER app line. Build, run, and verify with docker exec ... whoami that the process is no longer root. Then run with --memory=128m and watch what happens if your app exceeds it.No comments yet — be the first.