The Docker daemon (dockerd) runs with root privileges and controls all container operations. Hardening its configuration through /etc/docker/daemon.json, TLS certificates, user namespace remapping, and network restrictions is essential to prevent privilege escalation, lateral movement, and container breakout attacks.
When to Use
When deploying or configuring hardening docker daemon configuration capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prevents containers on the default bridge network from communicating. Each container must use explicit --link or user-defined networks with published ports.
Enable User Namespace Remapping
{"userns-remap":"default"}
Maps container root (UID 0) to a high unprivileged UID on the host. This prevents a container breakout from gaining root on the host.
# Verify userns-remap is activecat /etc/subuid
# Output: dockremap:100000:65536cat /etc/subgid
# Output: dockremap:100000:65536# Verify container UID mapping
docker run --rm alpine id# uid=0(root) gid=0(root) -- but host UID is 100000+
Disable New Privilege Escalation
{"no-new-privileges":true}
Prevents container processes from gaining additional privileges via setuid/setgid binaries or capability escalation.
Enable Live Restore
{"live-restore":true}
Keeps containers running during daemon downtime, enabling daemon upgrades without container restart.
Disable Userland Proxy
{"userland-proxy":false}
Uses iptables rules instead of docker-proxy for port forwarding, reducing attack surface and improving performance.
# Enable Docker Content Trustexport DOCKER_CONTENT_TRUST=1
# Pull only signed images
docker pull library/alpine:3.18
# Will fail if image is not signed# Sign and push image
docker trust sign myregistry/myapp:1.0
Seccomp Profile
# View default seccomp profile
docker info --format '{{.SecurityOptions}}'# Use custom seccomp profile
docker run --security-opt seccomp=/etc/docker/seccomp/custom.json alpine
# Verify seccomp is enabled
docker inspect --format='{{.HostConfig.SecurityOpt}}' container_name
