Docker Security Fundamentals

Docker containers have revolutionized application deployment, but they also introduce unique security challenges. This guide will help you understand the core security concepts when working with Docker and implement best practices to protect your containerized applications.

Introduction to Docker Security

Docker security focuses on protecting containerized applications and their host systems from threats. While containers provide some isolation by design, they don't offer the same security boundaries as virtual machines. Understanding Docker's security model is essential for building secure containerized environments.

The Docker Security Model

Docker's security architecture relies on several Linux kernel features:

Namespaces

Namespaces provide isolation between containers by creating separate views of system resources.

Namespace	Purpose
PID	Isolates process IDs
Network	Isolates network interfaces
IPC	Isolates inter-process communication
Mount	Isolates filesystem mount points
UTS	Isolates hostname and domain name
User	Isolates user and group IDs

Control Groups (cgroups)

Cgroups limit the resources (CPU, memory, I/O, network bandwidth) available to containers, preventing denial-of-service attacks.

Security Capabilities

Docker containers run with a restricted set of Linux capabilities, limiting what processes inside containers can do.

Securing Docker Images

Use Official and Verified Images

Always prefer official images from Docker Hub or trusted private registries:

bash

# Pulling an official image
docker pull nginx

# Pulling a specific version (preferred)
docker pull nginx:1.23.0

Scan Images for Vulnerabilities

Use Docker's integrated scanning or third-party tools to detect vulnerabilities:

bash

# Using Docker Scan (which uses Snyk)
docker scan nginx:latest

# Using Trivy (a popular open-source scanner)
trivy image nginx:latest

Create Minimal Images

Smaller images have fewer components that could contain vulnerabilities:

dockerfile

# Example of a multi-stage build to create a minimal image
FROM node:16 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

FROM node:16-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
COPY package*.json ./
USER node
CMD ["npm", "start"]

Never Include Secrets in Images

Secrets should never be hardcoded into Dockerfiles or included in layers:

dockerfile

# WRONG - Don't do this!
ENV AWS_ACCESS_KEY="AKIAIOSFODNN7EXAMPLE"

# BETTER - Use build arguments that don't persist in the image
ARG DATABASE_URL
RUN some-setup-command

# BEST - Use runtime secrets management
# No secrets in Dockerfile, use Docker secrets, environment variables, 
# or other secret management tools at runtime

Securing Docker Containers

Run Containers as Non-Root Users

By default, processes in containers run as root, which can be a security risk if the container is compromised:

dockerfile

# Create a user in the Dockerfile
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

When running containers:

bash

# Run container with a specific user
docker run --user 1000:1000 nginx

# Or use the user specified in the Dockerfile
docker run nginx

Limit Container Capabilities

Remove unnecessary Linux capabilities to reduce potential attack vectors:

bash

# Run with only needed capabilities
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx

Common capabilities to consider dropping:

Capability	Purpose
CAP_SYS_ADMIN	Admin operations (mount, etc.)
CAP_NET_ADMIN	Network configuration
CAP_SYS_MODULE	Insert/remove kernel modules
CAP_SYS_RAWIO	Direct I/O access

Use Read-Only Filesystems

Make your containers more secure by using read-only filesystems:

bash

# Run container with read-only filesystem
docker run --read-only nginx

If your application needs to write data, use specific volumes:

bash

# Allow writing only to specific directories
docker run --read-only -v /tmp -v /var/cache/nginx nginx

Implement Resource Limits

Prevent container resource exhaustion attacks:

bash

# Limit memory and CPU
docker run -m 512m --cpus=0.5 nginx

Securing the Docker Host and Daemon

Keep Docker Updated

Security vulnerabilities are regularly found and patched in Docker:

bash

# Check Docker version
docker version

# Update Docker through your package manager
sudo apt-get update && sudo apt-get upgrade docker-ce docker-ce-cli containerd.io

Secure the Docker Daemon

The Docker daemon socket is a critical security point:

bash

# AVOID exposing Docker daemon socket without TLS
# Don't do this in production:
docker -H tcp://0.0.0.0:2375 

# BETTER - Use TLS encryption
docker -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem

Use Docker Content Trust

Enable Docker Content Trust to ensure images are signed:

bash

# Enable Docker Content Trust
export DOCKER_CONTENT_TRUST=1
docker pull nginx:latest

Network Security for Docker

Use Custom Bridge Networks

Isolate containers by creating custom bridge networks:

bash

# Create a custom network
docker network create --driver bridge secure-network

# Run containers in the network
docker run --network secure-network --name app1 my-app
docker run --network secure-network --name db mysql

Limit Container Network Exposure

Only expose the ports your application needs:

bash

# Expose a single port
docker run -p 8080:80 nginx

# Limit binding to localhost
docker run -p 127.0.0.1:8080:80 nginx

Use Network Segmentation

Segment your container networks based on security needs:

bash

# Frontend network
docker network create frontend

# Backend network
docker network create backend

# Connect web server to frontend only
docker run --network frontend --name web nginx

# Connect application to both networks
docker run --network frontend --name app my-app
docker network connect backend app

# Connect database to backend only
docker run --network backend --name db postgres

Docker Secrets Management

Using Docker Secrets

Docker Swarm provides a secrets management system:

bash

# Create a secret
echo "my_secure_password" | docker secret create db_password -

# Use the secret in a service
docker service create \
    --name db \
    --secret db_password \
    --env POSTGRES_PASSWORD_FILE=/run/secrets/db_password \
    postgres

For Docker Compose:

yaml

version: '3.8'

services:
  db:
    image: postgres
    secrets:
      - db_password
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    file: ./db_password.txt

Security Monitoring and Audit

Enable Docker Audit Logging

Monitor Docker activities by enabling audit logs:

bash

# Configure Docker daemon with audit logging
# Add this to /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  }
}

Use Container Runtime Security

Implement runtime security tools to detect abnormal behavior:

bash

# Run Falco for runtime security monitoring
docker run -d --name falco \
  --privileged \
  -v /var/run/docker.sock:/var/run/docker.sock \
  falcosecurity/falco

Docker Security Best Practices Checklist

Use this checklist to ensure you're following security best practices:

1. ✅ Use trusted base images
2. ✅ Scan images for vulnerabilities
3. ✅ Keep Docker updated
4. ✅ Run containers as non-root users
5. ✅ Use read-only filesystems when possible
6. ✅ Implement resource limits
7. ✅ Drop unnecessary capabilities
8. ✅ Use Docker secrets for sensitive information
9. ✅ Implement network segmentation
10. ✅ Enable audit logging

Practical Example: Securing a Web Application

Let's put everything together to secure a simple web application:

dockerfile

# Dockerfile for secure web application
FROM node:16-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:16-alpine
# Create non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
# Copy only what's needed from the build stage
COPY --from=build --chown=appuser:appgroup /app/dist ./dist
COPY --from=build --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --chown=appuser:appgroup package*.json ./

# Use non-root user
USER appuser
EXPOSE 3000
CMD ["npm", "start"]

Run the container with security measures:

bash

docker build -t secure-webapp .

docker run -d \
  --name webapp \
  --read-only \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  -p 127.0.0.1:3000:3000 \
  -m 512m \
  --cpus=0.5 \
  --network app-network \
  secure-webapp

Docker Compose configuration:

yaml

version: '3.8'

services:
  webapp:
    build: .
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - "127.0.0.1:3000:3000"
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    networks:
      - frontend
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

networks:
  frontend:
    driver: bridge

Summary

Docker security requires a multi-layered approach addressing:

1. Image security: Use trusted images, scan for vulnerabilities, and create minimal images.
2. Container security: Run as non-root, limit capabilities, and implement resource limits.
3. Host and daemon security: Keep Docker updated and protect the Docker socket.
4. Network security: Use custom networks and limit exposure.
5. Secrets management: Use Docker secrets or external tools to manage sensitive data.

By implementing these fundamentals, you can significantly reduce the attack surface of your containerized applications.

Further Learning

To deepen your Docker security knowledge:

• Explore the Docker Security Documentation
• Practice using security scanning tools like Trivy, Clair, or Snyk
• Learn about Kubernetes security if you're using container orchestration
• Understand OWASP's container security verification standard

Practice Exercises

1. Create a Dockerfile for a web application that implements at least five security best practices.
2. Set up a Docker Compose configuration with proper network segmentation for a three-tier application.
3. Implement Docker Content Trust in your build pipeline.
4. Configure a container runtime security tool to monitor your Docker environment.
5. Perform a security audit of an existing Docker deployment and recommend improvements.