Limiting resources and capabilities when deploying your builds

You can limit a variety of resources available to your container, including CPU usage and memory. This can help prevent denial-of-service attacks. In this scenario, the container is exploited to use up the underlying resources of the host, thus causing overall performance degradation, or worse, the underlying host to crash.

Additionally, access control mechanisms are an important piece of the puzzle to ensure that as well as limiting the resources used by a container, we also limit privileges and access.

Limiting resources

In order to avoid the types of DOS attacks mentioned earlier, we can use a combination of flags to restrict how much of the underlying host resources a container can consume.

The first area we will look at is memory. Docker gives us the ability to restrict how much memory a container can use through a combination of hard and soft limits.

We can set a hard limit on a container using the...