Isolating Docker Containers

Docker container technology increases the default security by creating isolation layers between applications and between the application and host and reducing the host surface area which protects both the host and the co-located containers by restricting access to the host.

Table of Contents:

Below we have compiled publicly available sources from around the world that present views on Isolating Docker Containers.

The Container Security book by Liz Rice

Fundamental Technology Concepts that Protect Containerized Applications
Grab Your FREE Copy

Perspectives on Isolating Docker Containers

Docker Security Features: User Namespace

The purpose of User Namespace is similar to other types of Linux namespaces - isolation. It isolates user and group ID number spaces, so that a process’s user and group ID can be different inside and outside of a user namespace.

https://blog.aquasec.com/docker-1.10-user-namespace

Hardening Docker Hosts with User Namespaces

With some unchallenging configuration changes, it’s possible to segregate your host’s root user from the root user inside your containers with a not-so-new feature called User Namespaces. This feature has been around since Docker 1.10, which was released sometime around February 2016.

https://www.linux.com/blog/learn/2017/8/hardening-docker-hosts-user-namespaces

Making Containers More Isolated

unit42.paloaltonetworks.com

Vendor Information

Understanding the Isolation Properties of Docker

docker.com

Isolate Containers with a User Namespace

docs.docker.com

Further Reading

  • Docker Repository Security and Certificates — Docker runs via a non-networked Unix socket and TLS must be enabled in order to have the Docker client and the daemon communicate securely over HTTPS. This page gathers resources about how to ensure the traffic between the Docker registry and the Docker daemon is encrypted and a properly authenticated using certificate-based client-server authentication.
  • Docker Trusted Image Registry — Docker Trusted Registry (DTR) is the enterprise-grade image storage solution from Docker. It is installed behind a firewall so that Docker images can be securely stored and managed. This page gathers resources about the benefits of Docker trusted registry and how to work with it.
  • Docker AppArmor Security Profiles — AppArmor (Application Armor) is a Linux security module that protects an operating system and its applications from security threats. To use it, a system administrator associates an AppArmor security profile with each program. Docker expects to find an AppArmor policy loaded and enforced. This page gathers resources about Docker AppArmor security profiles and how to use them to enhance container security.
  • Isolating Docker Containers — Docker container technology increases the default security by creating isolation layers between applications and between the application and host and reducing the host surface area which protects both the host and the co-located containers by restricting access to the host.
  • Docker CIS Benchmark — The Center for Internet Security (CIS) Docker Benchmark is a reference document that can be used by system administrators, security and audit professionals and other IT roles to establish a secure configuration baseline for Docker containers. This page gather resources about CIS Docker benchmark and how to implement it.
Get updates on container technology