DEV Community

Sohail S Riyas
Sohail S Riyas

Posted on

Docker Security Practices:How to Correct the Common Misconfigurations

Docker simplifies containerization and accelerates software delivery, but its flexibility also opens doors for misconfiguration.
This guide dives into the most common Docker misconfigurations, explains why they matter, and provides actionable solutions you can start applying today.

1. Running Containers as Root

By default, containers run as root inside the container namespace. While isolated from the host (via namespaces and cgroups), this still creates a dangerous scenario: a container escape vulnerability (e.g. CVE-2019-5736, CVE-2021-41091) can escalate directly to host root.

How to fix it:

  • Create non-root users in your Dockerfile: 
RUN groupadd -g 1001 appuser && useradd -u 1001 -g appuser appuser
USER appuser
Enter fullscreen mode Exit fullscreen mode
  • Drop unnecessary Linux capabilities:

docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE ...

2. Using the --privileged Flag

The --privileged flag removes nearly all container isolation and grants full device access, all Linux capabilities, and host kernel interfaces. Attackers can gain full host control after a compromise.

How to fix it:

  • Avoid --privileged unless absolutely necessary.
  • Grant only specific capabilities with --cap-add.
  • Use device whitelisting carefully if absolutely required.

3. Mounting the Docker Socket Inside Containers

Mounting the Docker socket (/var/run/docker.sock) gives containers full access to the Docker daemon, equating to full root access on the host.

How to fix it:

  • Never mount Docker socket into production containers.
  • Use Sockguard, docker-proxy containers, or secured Docker-in-Docker setups if necessary.

4. Pulling Untrusted Images from Public Registries

Pulling images directly from public registries introduces risks like malicious maintainers, compromised base images, and supply chain poisoning.

How to fix it:

  • Use private registries for production.
  • Scan every image before promotion using Trivy, Grype, or Docker Scout.
  • Pin specific versions; avoid latest tags.

5. Storing Secrets in Environment Variables or Images

Secrets exposed via environment variables or Dockerfiles can leak through docker inspect, logs, or crashes.

How to fix it:

  • Never bake secrets into Docker images or ENV lines.
  • Use Docker Secrets (Swarm), Kubernetes Secrets, or external vaults (Vault,
  • AWS Secrets Manager, Azure Key Vault).
  • Rotate secrets regularly and enable auditing.

6. Exposing Unnecessary Ports

Published ports (-p) make container services directly accessible. Docker's NAT forwarding exposes published ports widely.

How to fix it:

  • Only publish what’s required:

    docker run -p 127.0.0.1:8080:8080 ...

  • Use internal Docker networks for isolation.

  • Apply firewall rules and reverse proxies.

7. Not Limiting Container Resources

Without limits, containers can consume unlimited resources, potentially starving the host.

How to fix it:

  • Apply resource constraints:

docker run --memory=512m --cpus=1 --pids-limit=100 ...

  • Use cgroups and monitor resource usage continuously.

8. Running Outdated Docker Engine Versions

Old Docker engine versions may contain critical vulnerabilities.

How to fix it:

  • Keep Docker Engine updated.
  • Subscribe to security advisories and CVE notifications.
  • Keep the host kernel patched as well.

9. Not Using Seccomp, AppArmor, or SELinux Profiles

Default security profiles may allow too many syscalls or file system operations.
How to fix it:

  • Apply Seccomp profiles to limit syscalls:

docker run --security-opt seccomp=default.json ...

  • Use AppArmor or SELinux for Mandatory Access Control.
  • Generate tailored profiles using security tools like docker-slim or oci-seccomp-bpf-hook.

10. Inadequate Logging & Monitoring

Without effective monitoring, security incidents can go undetected.
How to fix it:

  • Centralize logs using ELK stack, Fluentd, or Loki.
  • Deploy runtime security monitors like Falco, Sysdig Secure, or Aqua Security.
  • Set up automated alerting for suspicious activities.

Conclusion
Docker is powerful but not secure by default. Many misconfigurations stem from convenience shortcuts, insecure defaults, or lack of awareness.
For DevOps teams managing production environments, addressing these common mistakes is critical. Security is a continuous lifecycle: harden configurations, automate scanning and monitoring, and continuously review emerging threats. With attention to these areas, you can run Docker securely at scale.

Top comments (0)