Checklist · Servers

Docker host hardening

Settings for a server that runs containers with Docker, including the mistakes that quietly expose services.

Owner: Platform engineerTime: 45 min

0 of 19

The daemon

The Docker API is not exposed on TCP; if it must be, it uses mutual TLS and a firewall.
Membership of the docker group is treated as root access and limited to named administrators.
Rootless mode or user-namespace remapping is used where the workload allows it.
Default seccomp and AppArmor/SELinux profiles are left on.
json-file logs have max-size and max-file set, or a logging driver ships them off the host.
Docker and the host kernel are patched; the host runs nothing but containers and the agents.

Published ports are bound to 127.0.0.1 or an internal address unless the service is meant to be public. Docker publishes around the host firewall rules, so check from outside.
Databases, caches and admin consoles are on an internal network and are not published at all.
Containers that do not need to talk to each other are on separate networks.
External scan of the host shows only the ports on the approved list.

Images are pulled from the internal registry, pinned by digest, and scanned before they run.
Containers run as a non-root USER with a read-only root filesystem where possible.
No --privileged containers, and /var/run/docker.sock is not mounted into any container without a documented reason.
Linux capabilities are dropped with --cap-drop=ALL and only the needed ones added back.
CPU, memory and PID limits are set so one container cannot starve the host.
Secrets are mounted from a secret store at run time, not baked into images or written as environment variables in compose files.

Old images, stopped containers and build cache are pruned on a schedule, and disk alerts fire before the volume is full.
Volumes holding data are backed up; a restore has been tested.
A list of running containers, their image digests and owners is kept and compared with what is deployed.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14 dias de teste gratuito. Sem cartão. Cloud ou on-premises.