Docker
by Docker Inc.
Container runtime platform using Linux namespaces, cgroups, and kernel capabilities for application isolation
Authoritative Sources
Key guidance documents from authoritative organizations. Click to view the original source.
NIST SP 800-190 §4.4.3: "Containers should be run with their root filesystems in read-only mode... and run as a non-root user." §4.4.1: "Organizations should use security tools that can detect when images are run in production that do not meet the organization's standards." §3.3: "Container runtimes are susceptible to software vulnerabilities like any other software... an attacker exploiting a runtime vulnerability would potentially be able to access or modify data and workloads on any container on the host."
Configuration Examples(2)
Security configuration baseline for Docker deployments. Covers host configuration, daemon settings, container runtime, images, and Docker Swarm.
Configuration Examples(3)
Official Docker security guidance covering kernel namespaces, control groups, daemon attack surface, Linux capabilities, and content trust.
Configuration Examples(4)
SOC 2 CC6.1: "The entity implements logical access security software, infrastructure, and architectures over protected information assets." Docker security configurations including user namespaces, capabilities, and seccomp profiles implement logical access controls required for SOC 2 compliance. Source: AICPA Trust Services Criteria.
Verification Commands
Commands and queries for testing and verifying security configurations.
docker ps -a --format 'table {{.Names}} {{.Image}} {{.Status}}'docker inspect --format '{{json .HostConfig.SecurityOpt}}' <container>docker ps -q | xargs -I {} docker exec {} iddocker inspect --format '{{.HostConfig.CapAdd}} {{.HostConfig.CapDrop}}' <container>docker ps -q | xargs docker inspect --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'trivy image --severity HIGH,CRITICAL myimage:tagdocker run --rm --net host --pid host --userns host --cap-add audit_control -v /var/lib:/var/lib -v /var/run/docker.sock:/var/run/docker.sock -v /etc:/etc:ro docker/docker-bench-securitydocker system info --format "{{json .SecurityOptions}}"echo $DOCKER_CONTENT_TRUSTdocker images --digests --format "{{.Repository}}:{{.Tag}} {{.Digest}}"docker ps -q | xargs docker inspect --format '{{.Name}}: {{range .Mounts}}{{if eq .Type "bind"}}{{.Source}}->{{.Destination}} {{end}}{{end}}'docker stats --no-stream --format 'table {{.Name}} {{.MemUsage}} {{.MemPerc}} {{.CPUPerc}}'Related Controls
Security controls from various frameworks that relate to Docker.