Hardening
Run a service as a non-root user with no extra Linux capabilities, and what Auto, Required and Off mean.
A hardened service runs as a non-root user with every extra Linux capability dropped. If the app is ever compromised, the attacker holds far less inside the container.
Each web service and worker has a hardening policy. You set it when you create the service, and change it later under its Settings tab.
Policies
| Policy | What it does |
|---|---|
| Auto (default) | Hardens the service when Guidal can prove it is safe: the image declares a numeric non-root USER, and the service listens on port 1024 or above |
| Required | Always hardens, and refuses a deploy when the image is known to run as root or the port is below 1024 |
| Off | Never hardens the service |
The service's Overview tab says whether hardening is applied, which policy produced that result, and the image user Guidal found.
Make an image hardenable
Declare a numeric user in your Dockerfile, and listen on a port of 1024 or above:
dockerfile
USER 1001
EXPOSE 8080A user given by name (for example USER app) cannot be verified, so Auto leaves the service unhardened. Use the number instead.