Module 10: Docker Security
Security is one of the most important aspects of working with Docker. While containers improve consistency and portability, they also introduce new risks if not managed properly. In this module, we’ll cover best practices, tools, and techniques to secure your Docker environment.
🔹 1. Security Best Practices
Follow these core principles to keep your Docker workloads safe:
✅ Use least privilege – Run containers with only the resources and permissions they need.
✅ Use trusted images – Always pull from official sources or private registries.
✅ Keep images up to date – Regularly rebuild and update base images.
✅ Minimize image size – Smaller images reduce the attack surface.
🔹 2. Running Containers as Non-Root Users
By default, containers often run as root, which can be dangerous. Instead, create and use a non-root user inside your Dockerfile.
👉 Example:
FROM node:18-alpine
WORKDIR /app
COPY . .
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
CMD ["node", "server.js"]
✅ This prevents privilege escalation in case of a breach.
🔹 3. Docker Bench for Security
Docker Bench for Security is a script that checks for common security issues in your Docker setup.
👉 Run it:
docker run -it --net host --pid host --cap-add audit_control \
-v /var/lib:/var/lib \
-v /var/run/docker.sock:/var/run/docker.sock \
--label docker_bench_security \
docker/docker-bench-security
✅ Provides a detailed security report with recommendations.
🔹 4. Image Scanning Tools
Scanning Docker images for vulnerabilities is a must before deploying to production.
- Trivy – Simple and fast vulnerability scanner.
trivy image myapp:latest
- Clair – Powerful open-source tool for deeper image scanning.
✅ Both tools highlight CVEs (Common Vulnerabilities and Exposures) in your images.
🎯 Wrap Up
In this module, you learned how to:
Apply Docker security best practices
Run containers as non-root users
Use Docker Bench for auditing
Scan images with Trivy and Clair
By following these steps, you’ll greatly reduce security risks in your containerized environments.