hardening-docker-containers-for-production

name	hardening-docker-containers-for-production
description	Harden Dockerfiles, images, and container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only rootfs, seccomp/AppArmor, and minimal multi-stage images, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images/runtime configs against CIS Docker controls.
domain	cybersecurity
subdomain	container-security
tags	["containers","docker","security","hardening","CIS-benchmark"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
mitre_attack	["T1610","T1611","T1609","T1525","T1068"]

Hardening Docker Containers for Production

Overview

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.

When to Use

• When deploying or configuring hardening docker containers for production capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Docker Engine 24.0+ installed
• Docker Compose v2
• Linux host with kernel 5.10+
• Root or sudo access on Docker host
• docker-bench-security tool
• Hadolint for Dockerfile linting
• Dockle for image linting

Core Concepts

CIS Docker Benchmark Sections

1. Host Configuration - Audit Docker daemon files, restrict access to /var/run/docker.sock
2. Docker Daemon Configuration - Enable TLS, restrict inter-container communication, configure logging
3. Docker Daemon Configuration Files - Set ownership and permissions on daemon.json
4. Container Images and Build File - Use trusted base images, scan for vulnerabilities, multi-stage builds
5. Container Runtime - Drop capabilities, read-only rootfs, restrict syscalls
6. Docker Security Operations - Monitor, audit, and rotate credentials

Key Hardening Principles

• Least Privilege: Run containers as non-root, drop all capabilities except required
• Immutability: Use read-only root filesystem, tmpfs for writable directories
• Minimalism: Use distroless or Alpine base images, multi-stage builds
• Isolation: Apply seccomp profiles, AppArmor/SELinux, namespace restrictions
• Auditability: Enable content trust, log all container activity

Workflow

Step 1: Harden the Dockerfile

# Use specific digest for reproducibility
FROM python:3.12-slim@sha256:abc123... AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

# Production stage - minimal image
FROM gcr.io/distroless/python3-debian12

# Copy only necessary artifacts
COPY --from=builder /root/.local /root/.local
COPY --from=builder /app /app

WORKDIR /app

# Create non-root user
USER 65534:65534

# Set read-only filesystem expectation
LABEL org.opencontainers.image.source="https://github.com/org/app"

ENTRYPOINT ["python", "app.py"]