--- title: "Docker Container: Security Best Practices" description: "I have explained Docker security best practices in this post. The highlights are Docker security for Containers." url: https://srinimf.com/2020/12/13/how-docker-provides-security-to-its-containers/ date: 2020-12-13 modified: 2026-10-10 author: "Srini" image: https://i0.wp.com/srinimf.com/wp-content/uploads/2020/12/pexels-photo-4827499.jpeg?fit=1880%2C1253&ssl=1 categories: ["Docker", "Security"] tags: ["Docker Security"] type: post lang: en --- # Docker Container: Security Best Practices Here are Container security best practices in Docker. The best security feature in Docker is it isolates Containers and avoids container-to container communication. It stores **images** inside the container. The Image is a replica of the Software-application. You can keep multiple images of current and previous versions. So it is easy to control versions. Below sections helps you to know how Docker maintains Security. ## [Docker Container](https://srinimf.com/2018/12/25/docker-top-interview-questions/)s & Security In the below picture, the Docker isolates each container. Further, a container can’t communicate with another container and even the host-operating system – except for storage volumes. ![Docker Security.](https://i0.wp.com/srinimf.com/wp-content/uploads/2020/12/security.png?resize=471%2C321&ssl=1)*Highlights How Secure Containers* ## Security with Container Isolation Though each container has separate processes, these are encapsulated in the Linux Kernel (Host Operating System). The most important is the central functions of the Linux kernel, such as Cgroups and namespaces. [Here is an article more on Security.](https://docs.docker.com/engine/security/) The distribution of system resources (memory, CPU, bandwidth) takes place by means of a Cgroup mechanism that guarantees that each container can only consume the quota reserved for it. ![How Docker Handles Isolation Techniques](https://i0.wp.com/srinimf.com/wp-content/uploads/2020/12/docker-linux-interfaces.png?resize=300%2C276&ssl=1)*Ref: [Build, Ship, Run anywhere using Docker](https://delftswa.github.io/chapters/docker/)* Compared to Virtual Machine, the isolation in Docker is not much stricter. Due to this, an unauthorized attacker can spoil not only container data but also host operating systems’ Kernel. ## Docker Security Vulnerabilities The Os kernel is prone to security breach. The reason is it’s libraries communicate with Docker. So an attacker who breaks container can do for Kernel also. ## Docker Security Best Practices & Tools 1. A firewall is needed to stop attacking Host Os. You can achieve this by using the below frameworks: - **[AppArmor](https://apparmor.net/)** allows regulating the access rights of the containers to the file system. - **SELinux** presents a complex system of rules with which you can implement access controls to the kernel resources. - **[Seccomp](https://docs.docker.com/engine/security/seccomp/) (Secure Computing Mode)** monitors system calls. 2. Restrict access to Daemon (which is the heart of Docker) to avoid security problems. 3. The purpose of Registry is – it stores images, and you can pull them as well. So, safeguard the registry with the above frameworks. Keep Reading - [Docker: Client, Daemon, Hub and Registry](https://srinimf.com/2020/11/18/4-components-of-docker-engine-architecture/)DateNovember 18, 2020 - [Docker Container These Questions Helpful for Interviews](https://srinimf.com/2018/12/25/docker-top-interview-questions/)DateDecember 25, 2018 - [Mainframe Vs Docker Top Differences](https://srinimf.com/2018/12/08/undesratnd-docker-useful-for-legacy-programmers/)DateDecember 8, 2018 ### Share this: - - [Tweet](https://twitter.com/share) - [![](https://i0.wp.com/assets.pinterest.com/images/pidgets/pinit_fg_en_rect_gray_20.png)](https://www.pinterest.com/pin/create/link/?url=https%3A%2F%2Fsrinimf.com%2F2020%2F12%2F13%2Fhow-docker-provides-security-to-its-containers%2F&media=https%3A%2F%2Fi0.wp.com%2Fsrinimf.com%2Fwp-content%2Fuploads%2F2020%2F12%2Fpexels-photo-4827499.jpeg%3Ffit%3D1200%252C800%26ssl%3D1&description=Docker%20Container%3A%20Security%20Best%20Practices) - - [Share on Tumblr](https://www.tumblr.com/share) - [Share on WhatsApp (Opens in new window) WhatsApp](https://srinimf.com/2020/12/13/how-docker-provides-security-to-its-containers/?share=jetpack-whatsapp) - [More](#) - - [Print (Opens in new window) Print](https://srinimf.com/2020/12/13/how-docker-provides-security-to-its-containers/?share=print) - [Share on Reddit (Opens in new window) Reddit](https://srinimf.com/2020/12/13/how-docker-provides-security-to-its-containers/?share=reddit) - [Share on Telegram (Opens in new window) Telegram](https://srinimf.com/2020/12/13/how-docker-provides-security-to-its-containers/?share=telegram) - [Email a link to a friend (Opens in new window) Email](mailto:?subject=%5BShared%20Post%5D%20Docker%20Container%3A%20Security%20Best%20Practices&body=https%3A%2F%2Fsrinimf.com%2F2020%2F12%2F13%2Fhow-docker-provides-security-to-its-containers%2F&share=email) - ### Like this: Like Loading…