Docker Container Security: Beyond the Basics

Why Container Security Matters

Containers share the host kernel. A container escape means root on your entire machine. And with 2vCPU / 4GB RAM, you can’t afford a compromised container eating all your resources.

Rootless Docker

The single most impactful security change:

# Install rootless Docker
dockerd-rootless-setuptool.sh install

# Verify
docker context use rootless
docker info | grep -i root
# Security Options: rootless

Now even if an attacker escapes the container, they get your user — not root.

Resource Limits

Never let a container go unbounded:

services:
  blog:
    image: blog:latest
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'
    mem_swappiness: 0
    read_only: true
    tmpfs:
      - /tmp

Network Policies

Isolate containers from each other:

docker network create --internal blog-net
docker network create --internal db-net

Containers on blog-net can talk to each other but can’t reach the internet. Only the reverse proxy gets external access.

---

The best security is the kind that’s invisible to legitimate users and impenetrable to everyone else.