Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls. Use when working with hardening docker daemon configuration.
Instrucciones de origen · Vista previa de solo lectura
name
hardening-docker-daemon-configuration
description
Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls. Use when working with hardening docker daemon configuration.
The Docker daemon (dockerd) runs with root privileges and controls all container operations. Hardening its configuration through /etc/docker/daemon.json, TLS certificates, user namespace remapping, and network restrictions is essential to prevent privilege escalation, lateral movement, and container breakout attacks.
When to Use
Trigger phrases:
"hardening docker daemon configuration"
"Harden the Docker daemon by configuring daemon"
When deploying or configuring hardening docker daemon configuration capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
This section covers setting-by-setting explanation for hardening docker daemon configuration.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Disable Inter-Container Communication (ICC)
{"icc":false}
Prevents containers on the default bridge network from communicating. Each container must use explicit --link or user-defined networks with published ports.
Enable User Namespace Remapping
{"userns-remap":"default"}
Maps container root (UID 0) to a high unprivileged UID on the host. This prevents a container breakout from gaining root on the host.
# Verify userns-remap is activecat /etc/subuid
# Output: dockremap:100000:65536cat /etc/subgid
# Output: dockremap:100000:65536# Verify container UID mapping
docker run --rm alpine id# uid=0(root) gid=0(root) -- but host UID is 100000+
Disable New Privilege Escalation
{"no-new-privileges":true}
Prevents container processes from gaining additional privileges via setuid/setgid binaries or capability escalation.
Enable Live Restore
{"live-restore":true}
Keeps containers running during daemon downtime, enabling daemon upgrades without container restart.
Disable Userland Proxy
{"userland-proxy":false}
Uses iptables rules instead of docker-proxy for port forwarding, reducing attack surface and improving performance.
TLS Configuration for Remote Docker API
This section covers tls configuration for remote docker api for hardening docker daemon configuration.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
# Enable Docker Content Trustexport DOCKER_CONTENT_TRUST=1
# Pull only signed images
docker pull library/alpine:3.18
# Will fail if image is not signed# Sign and push image
docker trust sign myregistry/myapp:1.0
Seccomp Profile
# View default seccomp profile
docker info --format '{{.SecurityOptions}}'# Use custom seccomp profile
docker run --security-opt seccomp=/etc/docker/seccomp/custom.json alpine
# Verify seccomp is enabled
docker inspect --format='{{.HostConfig.SecurityOpt}}' container_name
