instruction: Create a Dockerfile for fundamentals
output: ```dockerfile
  from the network with
  docker pull. As of Docker 1.3.2, images are now extracted in a chrooted
  subprocess on Linux/Unix platforms, being the first-step in a wider effort
  toward privilege separation. As of Docker 1.10.0, all images are stored and
  accessed by the cryptographic checksums of their contents, limiting the
  possibility of an attacker causing a collision with an existing image.Finally, if you run Docker on a server, it is recommended to run
  exclusively Docker on the server, and move all other services within
  containers controlled by Docker. Of course, it is fine to keep your
  favorite admin tools (probably at least an SSH server), as well as
  existing monitoring/supervision processes, such as NRPE and collectd.Linux kernel capabilitiesBy default, Docker starts containers with a restricted set of
  capabilities. What does that mean?Capabilities turn the binary "root/non-root" dichotomy into a
  fine-grained access control system. Processes (like web servers) that
  just need to bind on a port below 1024 do not need to run as root: they
  can just be granted the net_bind_service capability instead. And there
  are many other capabilities, for almost all the specific areas where root
  privileges are usually needed. This means a lot for container security.Typical servers run several processes as root, including the SSH daemon,
  cron daemon, logging daemons, kernel modules, network configuration tools,
  and more. A container is different, because almost all of those tasks are
  handled by the infrastructure around the container:SSH access are typically managed by a single server running on
  the Docker hostcron, when necessary, should run as a user
  process, dedicated and tailored for the app that needs its
  scheduling service, rather than as a platform-wide facilityLog management is also typically handed to Docker, or to
  third-party services like Loggly or SplunkHardware management is irrelevant, meaning that you never need to
  run udevd or equivalent daemons within
  containersNetwork management happens outside of the containers, enforcing
  separation of concerns as much as possible, meaning that a container
  should never need to perform ifconfig,
  route, or ip commands (except when a container
  is specifically engineered to behave like a router or firewall, of
  course)This means that in most cases, containers do not need "real" root
  privileges at all* And therefore, containers can run with a reduced
  capability set; meaning that "root" within a container has much less
  privileges than the real "root". For instance, it is possible to:Deny all "mount" operationsDeny access to raw sockets (to prevent packet spoofing)Deny access to some filesystem operations, like creating new device
  nodes, changing the owner of files, or altering attributes (including
  the immutable flag)Deny module loadingThis means that even if an intruder manages to escalate to root within a
  container, it is much harder to do serious damage, or to escalate
  to the host.This doesn't affect regular web apps, but reduces the vectors of attack by
  malicious users considerably. By default Docker
  drops all capabilities except those
  needed,
  an allowlist instead of a denylist approach. You can see a full list of
  available capabilities in Linux
  manpages.One primary risk with running Docker containers is that the default set
  of capabilities and mounts given to a container may provide incomplete
  isolation, either independently, or when used in combination with
  kernel vulnerabilities.Docker supports the addition and removal of capabilities, allowing use
  of a non-default profile. This may make Docker more secure through
  capability removal, or less secure through the addition of capabilities.
  The best practice for users would be to remove all capabilities except
  those explicitly required for their processes.Docker Content Trust signature verificationDocker Engine can be configured to only run signed images. The Docker Content
  Trust signature verification feature is built directly into the dockerd binary.This is configured in the Dockerd configuration file.To enable this feature, trustpinning can be configured in daemon.json, whereby
  only repositories signed with a user-specified root key can be pulled and run.This feature provides more insight to administrators than previously available with
  the CLI for enforcing and performing image signature verification.For more information on configuring Docker Content Trust Signature Verification, go to
  Content trust in Docker.Other kernel security featuresCapabilities are just one of the many security features provided by
  modern Linux kernels. It is also possible to leverage existing,
  well-known systems like TOMOYO, AppArmor, SELinux, GRSEC, etc. with
  Docker.While Docker currently only enables capabilities, it doesn't interfere
  with the other systems. This means that there are many different ways to
  harden a Docker host. Here are a few examples.You can run a kernel with GRSEC and PAX. This adds many safety
  checks, both at compile-time and run-time; it also defeats many
  exploits, thanks to techniques like address randomization. It doesn't
  require Docker-specific configuration, since those security features
  apply system-wide, independent of containers.If your distribution comes with security model templates for
  Docker containers, you can use them out of the box. For instance, we
  ship a template that works with AppArmor and Red Hat comes with SELinux
  policies for Docker. These templates provide an extra safety net (even
  though it overlaps greatly with capabilities).You can define your own policies using your favorite access control
  mechanism.Just as you can use third-party tools to augment Docker containers, including
  special network topologies or shared filesystems, tools exist to harden Docker
  containers without the need to modify Docker itself.As of Docker 1.10 User Namespaces are supported directly by the docker
  daemon. This feature allows for the root user in a container to be mapped
  to a non uid-0 user outside the container, which can help to mitigate the
  risks of container breakout. This facility is available but not enabled
  by default.Refer to the
  daemon command
  in the command line reference for more information on this feature.
  Additional information on the implementation of User Namespaces in Docker
  can be found in
  this blog post.ConclusionsDocker containers are, by default, quite secure; especially if you
  run your processes as non-privileged users inside the container.You can add an extra layer of safety by enabling AppArmor, SELinux,
  GRSEC, or another appropriate hardening system.If you think of ways to make docker more secure, we welcome feature requests,
  pull requests, or comments on the Docker community forums.Related informationUse trusted imagesSeccomp security profiles for DockerAppArmor security profiles for DockerOn the Security of Containers (2014)Docker swarm mode overlay network security model
  Request changesTable of contentsKernel namespacesControl groupsDocker daemon attack surfaceLinux kernel capabilitiesDocker Content Trust signature verificationOther kernel security featuresConclusionsRelated information
  
  Product offerings
  Pricing
  About us
  Contribute
  Read llms.txt
  Cookies Settings
  
  Status
  Legal```