Docker containers aren’t automatically secure. Go through this checklist.
Image¶
- ☐ Official or verified base image
- ☐ Pinned tag (not :latest)
- ☐ Multi-stage build (minimal final image)
- ☐ Image scanning (Trivy, Snyk)
- ☐ No secrets in image layers
Runtime¶
- ☐ Non-root user
- ☐ Read-only filesystem where possible
- ☐ Drop all capabilities, add only needed ones
- ☐ Seccomp/AppArmor profile
- ☐ Resource limits (memory, CPU)
Network¶
- ☐ Minimal exposed ports
- ☐ Custom network (not default bridge)
- ☐ TLS for inter-container communication
Host¶
- ☐ Docker daemon without TCP (socket only)
- ☐ User namespace remapping
- ☐ Current Docker version
- ☐ Log rotation configured
Tool¶
Run docker bench security (github.com/docker/docker-bench-security) for automated audit.
dockersecuritycontainers