Category: Docker

Default Docker is barely a container at all — root, mutable, all caps, shared kernel. This is the ten-flag hardening checklist that turns it into something a real attacker has to work to break: rootless, read-only, cap-drop, no-new-privileges, distroless, secrets, segmentation, scanning. With a worked NGINX + PHP-FPM compose example.

Run your own password manager with self-hosted Vaultwarden — a tiny Docker image, full Bitwarden client compatibility, and total control over your encrypted vault.

docker-cms is a PHP 8.5 Docker container loaded with WP-CLI, Composer, Xdebug, database clients, and every tool you need to maintain and debug WordPress — without touching your live server.