Docker Hardening and Security Controls

I set out to review and validate the layered security controls available for Docker containers, covering daemon access, resource limits, capabilities, system call filtering, mandatory access control, and image security.

A Docker environment needed a security baseline. Rather than focusing on a single weakness, I reviewed each layer of Docker security to understand what controls were available, how they worked, and how to validate them. The goal was to build a practical reference for hardening Docker deployments.

1. 01
   Reviewed daemon access

   I assessed SSH-based Docker contexts for remote management and TLS for encrypted, authenticated API communication.

2. 02
   Reviewed resource controls

   I inspected cgroup limits for CPU and memory using docker inspect. A value of 0 indicated no limit was configured.

3. 03
   Reviewed capabilities

   I assessed privileged containers versus the recommended approach of dropping all capabilities and adding only specific ones. I used capsh --print to display assigned capabilities.

4. 04
   Reviewed system call filtering

   I assessed seccomp profiles for restricting the system calls available to container processes.

5. 05
   Reviewed mandatory access control

   I assessed AppArmor profiles using aa-status and apparmor_parser for restricting application resource access.

6. 06
   Reviewed image security

   I inspected Dockerfiles and image layers to identify potentially insecure build practices or suspicious commands.

# Control validation summary
docker context create:  SSH-based remote management configured
docker inspect:         Resource limits reviewed (CPU, memory)
capsh --print:          Capability sets displayed and assessed
aa-status:              AppArmor profiles reviewed
Dockerfile review:      Image layers inspected for insecure practices

Each control layer was reviewed and validated on the running environment:

1. 01Use SSH-based Docker contexts or mutual TLS for all remote Docker management, never an unauthenticated TCP socket.
2. 02Set CPU and memory limits on every container using cgroups to prevent resource exhaustion.
3. 03Drop all capabilities by default and add only the ones the application needs.
4. 04Apply seccomp profiles to restrict system calls to the minimum set required.
5. 05Load and enforce AppArmor profiles to limit what container processes can access on the host.
6. 06Review Dockerfiles and image layers before deploying, and scan images for known vulnerabilities.