Restricting access to Docker container contents

Question

Is it possible to disallow attaching to a Docker container or otherwise restrict access to the file contents of a container? The use case is distribution of a PHP app where it is not desirable to allow the user to access or modify the app's files. If that's not possible with Docker, are there any alternatives short of a full VM that better fit this use case?

Answer 1

No, you cannot. Docker does not, and cannot, restrict the capabilities of the host. (Note that even a full VM would not help here; it would still be possible to mount its hard disk and view its contents.)

If you want to prevent viewing or modification of your PHP application's source code, look into PHP source encoders, such as Zend Encoder or IonCube.