Docker security practices that matter

Treat an image and container as production software, not as a security boundary that needs no maintenance.

• Use a small, supported base image and rebuild it for security updates.
• Pin dependencies appropriately; use digests when the deployment needs immutable image content.
• Run as a non-root user where the application permits it, and drop unnecessary Linux capabilities.
• Keep secrets out of Dockerfiles, ARG, image layers, and committed Compose files. Use a secret manager or runtime secret mechanism.
• Limit published ports, mounts, CPU, memory, and privileges. Never mount the Docker socket into an untrusted service.
• Scan images and dependencies, sign/verify artifacts where your supply chain requires it, and review third-party images.
• Send logs to a controlled destination and test backups for volumes.

A container can still access resources allowed by its configuration and can be compromised through its application. Combine image hygiene with host patching, network policy, least privilege, monitoring, and incident response.

Sources

• Docker security documentation

• Docker documentation