Record · corpus.blog/posts/01a0875c-36f2-7316-b58d-7e43d2183ace

Building Docker Images Without Root or Privilege Escalation

candrews.integralblue.com · published 12 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at candrews.integralblue.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 37
Words captured: 2,795

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://csrc.nist.gov/glossary/term/least_privilege

csrc.nist.gov

https://docs.kernel.org/userspace-api/no_new_privs.html

docs.kernel.org

https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html

freedesktop.org

https://docs.docker.com/reference/dockerfile/

docs.docker.com

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

kubernetes.io

https://github.com/kubernetes/kubernetes/pull/56503

github.com

https://kyverno.io/policies/pod-security/restricted/require-run-as-nonroot/require-run-as-nonroot/

kyverno.io

https://kyverno.io/policies/pod-security/restricted/disallow-privilege-escalation/disallow-privilege-escalation/

kyverno.io

https://kubernetes.io/docs/concepts/security/pod-security-standards/

kubernetes.io

https://buildpacks.io/

buildpacks.io

https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/

buildpacks.io

https://docs.spring.io/spring-boot/gradle-plugin/packaging-oci-image.html

docs.spring.io

https://github.com/GoogleContainerTools/kaniko/issues/3348

github.com

https://podman.io/

podman.io

https://buildah.io/

buildah.io

https://www.docker.com/

docker.com

https://docs.docker.com/build/buildkit/

docs.docker.com

https://docs.docker.com/engine/security/rootless/

docs.docker.com

https://github.com/moby/buildkit/issues/1671

github.com

https://github.com/containers/buildah/discussions/5842

github.com

https://www.qemu.org/

qemu.org

https://github.com/qemus/qemu-docker/

github.com

https://www.qemu.org/docs/master/system/i386/microvm.html

qemu.org

https://firecracker-microvm.github.io/

firecracker-microvm.github.io

https://candrews.integralblue.com/2019/11/linters-keys-to-secure-maintainable-quality-devsecops/

candrews.integralblue.com

New helper added: ShellCheck – Finds bugs in your shell scripts. Read at the source ↗

shellcheck.net

https://docs.docker.com/build/checks/

docs.docker.com

Always Use Docker Image Digests Read at the source ↗

candrews.integralblue.com

https://en.wikipedia.org/wiki/Eating_your_own_dog_food

en.wikipedia.org

https://docs.docker.com/build/metadata/attestations/slsa-definitions/

docs.docker.com

https://github.com/opencontainers/image-spec/blob/v1.1.0/annotations.md

github.com

https://docs.docker.com/build/concepts/context/

docs.docker.com

https://docs.gitlab.com/ee/ci/docker/using_docker_images.html

docs.gitlab.com

https://linux-kvm.org/

linux-kvm.org

https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/the-nitro-system-journey.html

docs.aws.amazon.com

https://github.com/squat/generic-device-plugin/

github.com

https://medium.com/@lemonchoismarceau/running-cuttlefish-in-a-non-privileged-pod-b236c8701610

medium.com