Base de Conhecimento

Docker's convenience can create security blind spots if containers are deployed with default, permissive settings. This guide covers the practical security measures every production Docker host should have.

1. Never Run Containers as Root Unnecessarily

Many official images support running as a non-root user. Check the image documentation, or specify explicitly:

docker run --user 1000:1000 myimage

In a Dockerfile:

USER appuser

2. Limit Who Can Access the Docker Group

Membership in the docker group is effectively root-equivalent access to the host — a container can be used to mount and modify the host filesystem. Only add trusted users:

sudo usermod -aG docker trusted_user

3. Only Use Trusted Images

Prefer official images or verified publishers on Docker Hub. Avoid pulling random third-party images without reviewing their source.

4. Pin Image Versions

Avoid :latest in production — it can silently introduce breaking changes on redeploy:

image: nginx:1.27.0

5. Set Resource Limits

Prevent a single container from exhausting host resources:

docker run -d --memory=512m --cpus=0.5 myimage

In Compose:

deploy:
  resources:
    limits:
      memory: 512M
      cpus: '0.5'

6. Don't Expose the Docker Daemon Over the Network

Never bind the Docker daemon socket to a public TCP port without TLS and authentication — it grants full control over the host to anyone who can reach it.

7. Scan Images for Known Vulnerabilities

docker scout cves myimage:latest

8. Keep Docker Engine Updated

See How to Update Docker and Docker Compose Safely — security fixes are regularly released.

9. Use Read-Only Filesystems Where Possible

docker run --read-only myimage

This prevents a compromised container from writing to its own filesystem, limiting attacker persistence.

10. Manage Secrets Properly

Never hardcode passwords or API keys directly in a Dockerfile or committed docker-compose.yml. Use a .env file excluded from version control, or a proper secrets manager for larger deployments.

11. Restrict Container-to-Container Access

Use custom networks so only the containers that genuinely need to communicate can reach each other — see Docker Networking Explained.

12. Log and Monitor Container Activity

See Managing Docker Logs for centralizing and reviewing container output.

Quick Security Checklist

• Containers run as non-root where the image supports it
• docker group membership restricted to trusted admins
• Image versions pinned, not :latest, in production
• Resource limits set on all production containers
• Docker daemon not exposed on a public network port
• Secrets kept out of version control

FAQ

Is Docker itself inherently insecure?
No — Docker is widely used in production safely, but its default settings prioritize convenience over hardened security, so following these practices matters.

Related Articles

• How to Install Docker Engine on Ubuntu & Debian
• Docker Networking Explained
• VPS Security Checklist for Beginners