Hardening Docker Containers for Production

面向生产环境的Docker容器加固

Overview

概述

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.

面向生产环境的Docker容器加固需遵循CIS Docker Benchmark v1.8.0的安全最佳实践，以最小化攻击面、防止权限提升，并在Docker守护进程、镜像、容器及运行时配置中贯彻最小权限原则。

When to Use

适用场景

When deploying or configuring hardening docker containers for production capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

在您的环境中部署或配置面向生产的Docker容器加固能力时
建立符合合规要求的安全控制措施时
构建或改进该领域的安全架构时
开展需要此实现的安全评估时

Prerequisites

前提条件

Docker Engine 24.0+ installed
Docker Compose v2
Linux host with kernel 5.10+
Root or sudo access on Docker host
docker-bench-security tool
Hadolint for Dockerfile linting
Dockle for image linting

已安装Docker Engine 24.0+
Docker Compose v2
内核版本5.10+的Linux主机
Docker主机的Root或sudo权限
docker-bench-security工具
用于Dockerfile检查的Hadolint
用于镜像检查的Dockle

Core Concepts

核心概念

CIS Docker Benchmark Sections

CIS Docker基准章节

Host Configuration - Audit Docker daemon files, restrict access to /var/run/docker.sock
Docker Daemon Configuration - Enable TLS, restrict inter-container communication, configure logging
Docker Daemon Configuration Files - Set ownership and permissions on daemon.json
Container Images and Build File - Use trusted base images, scan for vulnerabilities, multi-stage builds
Container Runtime - Drop capabilities, read-only rootfs, restrict syscalls
Docker Security Operations - Monitor, audit, and rotate credentials

主机配置 - 审计Docker守护进程文件，限制对/var/run/docker.sock的访问
Docker守护进程配置 - 启用TLS，限制容器间通信，配置日志
Docker守护进程配置文件 - 设置daemon.json的所有权与权限
容器镜像与构建文件 - 使用可信基础镜像，扫描漏洞，多阶段构建
容器运行时 - 丢弃权限，只读根文件系统，限制系统调用
Docker安全运维 - 监控、审计及轮换凭证

Key Hardening Principles

核心加固原则

Least Privilege: Run containers as non-root, drop all capabilities except required
Immutability: Use read-only root filesystem, tmpfs for writable directories
Minimalism: Use distroless or Alpine base images, multi-stage builds
Isolation: Apply seccomp profiles, AppArmor/SELinux, namespace restrictions
Auditability: Enable content trust, log all container activity

最小权限：以非root用户运行容器，仅保留必要权限，丢弃其余所有权限
不可变性：使用只读根文件系统，为可写目录配置tmpfs
极简主义：使用无发行版（distroless）或Alpine基础镜像，多阶段构建
隔离性：应用seccomp配置文件、AppArmor/SELinux、命名空间限制
可审计性：启用内容信任，记录所有容器活动

Workflow

实施流程

Step 1: Harden the Dockerfile

步骤1：加固Dockerfile

dockerfile

undefined

dockerfile

undefined

Use specific digest for reproducibility

FROM python:3.12-slim@sha256:abc123... AS builder

WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim@sha256:abc123... AS builder

WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir --user -r requirements.txt

Production stage - minimal image

FROM gcr.io/distroless/python3-debian12

Copy only necessary artifacts

COPY --from=builder /root/.local /root/.local COPY --from=builder /app /app

WORKDIR /app

COPY --from=builder /root/.local /root/.local COPY --from=builder /app /app

WORKDIR /app

Create non-root user

USER 65534:65534

Set read-only filesystem expectation

LABEL org.opencontainers.image.source="https://github.com/org/app"

ENTRYPOINT ["python", "app.py"]

undefined

LABEL org.opencontainers.image.source="https://github.com/org/app"

ENTRYPOINT ["python", "app.py"]

undefined

Step 2: Harden Docker Daemon Configuration

步骤2：加固Docker守护进程配置

json

{
  "icc": false,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    },
    "nproc": {
      "Name": "nproc",
      "Hard": 1024,
      "Soft": 1024
    }
  },
  "seccomp-profile": "/etc/docker/seccomp-default.json",
  "tls": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "tlsverify": true
}

json

{
  "icc": false,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    },
    "nproc": {
      "Name": "nproc",
      "Hard": 1024,
      "Soft": 1024
    }
  },
  "seccomp-profile": "/etc/docker/seccomp-default.json",
  "tls": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "tlsverify": true
}

Step 3: Harden Container Runtime

步骤3：加固容器运行时

bash

docker run -d \
  --name production-app \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=100m \
  --tmpfs /var/run:rw,noexec,nosuid,size=10m \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  --security-opt seccomp=/etc/docker/seccomp-default.json \
  --security-opt apparmor=docker-default \
  --pids-limit 100 \
  --memory 512m \
  --memory-swap 512m \
  --cpus 1.0 \
  --user 65534:65534 \
  --network custom-bridge \
  --restart on-failure:3 \
  --health-cmd "curl -f http://localhost:8080/health || exit 1" \
  --health-interval 30s \
  --health-timeout 10s \
  --health-retries 3 \
  myapp:latest

bash

docker run -d \
  --name production-app \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=100m \
  --tmpfs /var/run:rw,noexec,nosuid,size=10m \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  --security-opt seccomp=/etc/docker/seccomp-default.json \
  --security-opt apparmor=docker-default \
  --pids-limit 100 \
  --memory 512m \
  --memory-swap 512m \
  --cpus 1.0 \
  --user 65534:65534 \
  --network custom-bridge \
  --restart on-failure:3 \
  --health-cmd "curl -f http://localhost:8080/health || exit 1" \
  --health-interval 30s \
  --health-timeout 10s \
  --health-retries 3 \
  myapp:latest

Step 4: Enable Docker Content Trust

步骤4：启用Docker内容信任

bash

export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://notary.example.com

bash

export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://notary.example.com

Sign and push image

docker trust sign myregistry.com/myapp:v1.0.0

Verify image signature before pull

docker trust inspect --pretty myregistry.com/myapp:v1.0.0

undefined

docker trust inspect --pretty myregistry.com/myapp:v1.0.0

undefined

Step 5: Configure Host-Level Auditing

步骤5：配置主机级审计

bash

undefined

bash

undefined

Add audit rules for Docker files and directories

cat >> /etc/audit/rules.d/docker.rules << 'EOF' -w /usr/bin/docker -k docker -w /var/lib/docker -k docker -w /etc/docker -k docker -w /lib/systemd/system/docker.service -k docker -w /lib/systemd/system/docker.socket -k docker -w /etc/default/docker -k docker -w /etc/docker/daemon.json -k docker -w /usr/bin/containerd -k docker -w /usr/bin/runc -k docker EOF

systemctl restart auditd

undefined

cat >> /etc/audit/rules.d/docker.rules << 'EOF' -w /usr/bin/docker -k docker -w /var/lib/docker -k docker -w /etc/docker -k docker -w /lib/systemd/system/docker.service -k docker -w /lib/systemd/system/docker.socket -k docker -w /etc/default/docker -k docker -w /etc/docker/daemon.json -k docker -w /usr/bin/containerd -k docker -w /usr/bin/runc -k docker EOF

systemctl restart auditd

undefined

Validation Commands

验证命令

bash

undefined

bash

undefined

Run Docker Bench Security

docker run --rm --net host --pid host
--userns host --cap-add audit_control
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST
-v /etc:/etc:ro
-v /usr/bin/containerd:/usr/bin/containerd:ro
-v /usr/bin/runc:/usr/bin/runc:ro
-v /usr/lib/systemd:/usr/lib/systemd:ro
-v /var/lib:/var/lib:ro
-v /var/run/docker.sock:/var/run/docker.sock:ro
docker/docker-bench-security

Lint Dockerfile

hadolint Dockerfile

Lint built image

dockle myapp:latest

Verify no containers running as root

docker ps -q | xargs docker inspect --format '{{.Id}}: User={{.Config.User}}'

undefined

docker ps -q | xargs docker inspect --format '{{.Id}}: User={{.Config.User}}'

undefined

Key Security Controls

关键安全控制

Control	Implementation	CIS Section
Non-root user	USER instruction in Dockerfile	4.1
Read-only rootfs	--read-only flag	5.12
Drop capabilities	--cap-drop ALL	5.3
Resource limits	--memory, --cpus, --pids-limit	5.10
No new privileges	--security-opt no-new-privileges	5.25
Content trust	DOCKER_CONTENT_TRUST=1	4.5
TLS for daemon	daemon.json TLS config	2.6
Audit logging	auditd rules	1.1

控制项	实现方式	CIS章节
非root用户	Dockerfile中的USER指令	4.1
只读根文件系统	--read-only参数	5.12
丢弃权限	--cap-drop ALL	5.3
资源限制	--memory、--cpus、--pids-limit	5.10
禁止新权限	--security-opt no-new-privileges	5.25
内容信任	DOCKER_CONTENT_TRUST=1	4.5
守护进程TLS	daemon.json中的TLS配置	2.6
审计日志	auditd规则	1.1

hardening-docker-containers-for-production

Original

Translation

Hardening Docker Containers for Production

面向生产环境的Docker容器加固

Overview

概述

When to Use

适用场景

Prerequisites

前提条件

Core Concepts

核心概念

CIS Docker Benchmark Sections

CIS Docker基准章节

Key Hardening Principles

核心加固原则

Workflow

实施流程

Step 1: Harden the Dockerfile

步骤1：加固Dockerfile

Use specific digest for reproducibility

Use specific digest for reproducibility

Production stage - minimal image

Production stage - minimal image

Copy only necessary artifacts

Copy only necessary artifacts

Create non-root user

Create non-root user

Set read-only filesystem expectation

Set read-only filesystem expectation

Step 2: Harden Docker Daemon Configuration

步骤2：加固Docker守护进程配置

Step 3: Harden Container Runtime

步骤3：加固容器运行时

Step 4: Enable Docker Content Trust

步骤4：启用Docker内容信任

Sign and push image

Sign and push image

Verify image signature before pull

Verify image signature before pull

Step 5: Configure Host-Level Auditing

步骤5：配置主机级审计

Add audit rules for Docker files and directories

Add audit rules for Docker files and directories

Validation Commands

验证命令

Run Docker Bench Security

Run Docker Bench Security

Lint Dockerfile

Lint Dockerfile

Lint built image

Lint built image

Verify no containers running as root

Verify no containers running as root

Key Security Controls

关键安全控制

References

参考资料