Docker Security Best Practices: How to Secure Your Containers

To secure Docker containers, use minimal base images, run containers with non-root users, and keep images updated. Also, manage secrets carefully with Docker secrets or environment variables and limit container capabilities to reduce risks.

Syntax

Here are key Docker commands and options to improve security:

• docker run --user: Run container as a non-root user.
• docker build --no-cache: Build images without cache to avoid stale layers.
• docker secret create: Manage sensitive data securely.
• docker network create --internal: Create isolated networks.
• docker run --cap-drop: Drop Linux capabilities to limit container privileges.

bash

docker run --user 1000:1000 myimage

docker secret create my_secret ./secret.txt

docker run --cap-drop ALL myimage

docker network create --internal my_internal_net

Example

This example shows how to run a Docker container securely by using a minimal image, running as a non-root user, and dropping all Linux capabilities.

dockerfile

FROM alpine:3.18

RUN addgroup -S appgroup && adduser -S appuser -G appgroup

USER appuser

CMD ["sh", "-c", "echo Hello from secure container"]

Common Pitfalls

Common mistakes include running containers as root, using large images with unnecessary packages, and exposing secrets in environment variables or image layers. Avoid using the latest tag in production as it can lead to unpredictable updates. Also, not limiting container capabilities can increase attack surface.

dockerfile

### Wrong way: running as root and exposing secrets
FROM ubuntu:22.04
ENV SECRET_KEY=mysecret
CMD ["bash"]

### Right way: use non-root user and Docker secrets
FROM ubuntu:22.04
RUN groupadd appgroup && useradd -m -g appgroup appuser
USER appuser
CMD ["bash"]

Quick Reference

• Use minimal base images like alpine to reduce attack surface.
• Run containers as non-root users with --user.
• Manage secrets with docker secret or external vaults.
• Keep images and Docker engine updated.
• Limit container capabilities with --cap-drop and --security-opt.
• Use Docker networks to isolate containers.

Key Takeaways

Always run containers as non-root users to minimize risk.

Use minimal base images to reduce vulnerabilities.

Manage secrets securely using Docker secrets or external tools.

Limit container capabilities and isolate networks to reduce attack surface.

Keep Docker engine and images up to date with security patches.