Containers share the host kernel, so a weak container config is a path to the host. Hardening Docker is now part of any server baseline.
The essentials
# don't run as root inside the container
USER appuser # in your Dockerfile
# drop capabilities, no new privileges, read-only fs
docker run --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
--read-only --tmpfs /tmp myimage| Risk | Fix |
|---|---|
| Running as root | USER directive; rootless Docker |
--privileged |
Almost never use it |
Mounting /var/run/docker.sock |
= host root. Avoid. |
| Secrets in image layers | Use env/secrets, not COPY (Secrets Management) |
| Stale base images | Rebuild & scan regularly |
Scan your images
trivy image myimage:latest # CVEs in OS packages + deps
docker scout cves myimage:latestPrinciple: a container is a process, not a VM — treat the boundary as thin. For exposed services, pair with a host firewall.
Related: Linux Server Hardening Baseline · Secrets Management · Vector Databases for Local AI