And ANSSI Says: Here’s How to Secure a Container

on YouTube ↗45m

" summary

Applies ANSSI Docker guidance to a VM-per-VM Docker Compose setup: enforces memory and CPU limits, assigns distinct cgroups per container, centralizes logs to Logstash via the GELF driver, isolates networks per service, and drops most kernel capabilities using cap_drop all (effective for ~90% of services). Replaces docker-in-docker with kaniko for image builds, notes read-only root and per-container user namespaces with bind mounts are impractical, and concludes the changes greatly reduce attack surface though builds and application-level security still need further work.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 3:10Docker context and use
3. 7:23Container resource limits
4. 10:54Filesystem security
5. 16:51Docker log management
6. 18:37Network security
7. 22:27Namespaces isolation
8. 27:46Kernel capability reduction
9. 30:10Rules in practice
10. 37:54Build security and conclusion
11. 40:41Q&A

" related talks

• 33mDocker SecurityAdrian Mouat · GOTO London 2015
• 14mYour Containers Aren’t Alone: Demystifying Container IsolationMarina Moore · Open Source Summit Europe 2025
• 47mContainer SecurityDaniel Walsh · LISA18
• 35mDocker SecurityAdrian Mouat · GOTO Stockholm 2016
• 31mYour Containers Aren’t Alone: Demystifying Container IsolationMarina Moore · Open Source Summit Europe 2025
• 33mContainers Security Layers and How Not to Break themAviv Sasson · ContainerCon @ Open Source Summit North America 2022
• 46mSecuring Applications and Pipelines on a Container PlatformVeer Muchandi · Open Source 101 at Home 2020
• 16mSecurity and Kubernetes: Should We Go Back to VMs?Olivier Dupré · Devoxx France 2021