Agent skill

hardening-docker-containers-for-production

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas

View SKILL.md on GitHub Repository
Stars 0
Forks 0

Install this agent skill to your Project

npx add-skill https://github.com/autohandai/community-skills/tree/main/hardening-docker-containers-for-production

SKILL.md

Hardening Docker Containers for Production

Overview

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce least-privilege principles across Docker daemon, images, containers, and runtime configurations.

Prerequisites

  • Docker Engine 24.0+ installed
  • Docker Compose v2
  • Linux host with kernel 5.10+
  • Root or sudo access on Docker host
  • docker-bench-security tool
  • Hadolint for Dockerfile linting
  • Dockle for image linting

Core Concepts

CIS Docker Benchmark Sections

  1. Host Configuration - Audit Docker daemon files, restrict access to /var/run/docker.sock
  2. Docker Daemon Configuration - Enable TLS, restrict inter-container communication, configure logging
  3. Docker Daemon Configuration Files - Set ownership and permissions on daemon.json
  4. Container Images and Build File - Use trusted base images, scan for vulnerabilities, multi-stage builds
  5. Container Runtime - Drop capabilities, read-only rootfs, restrict syscalls
  6. Docker Security Operations - Monitor, audit, and rotate credentials

Key Hardening Principles

  • Least Privilege: Run containers as non-root, drop all capabilities except required
  • Immutability: Use read-only root filesystem, tmpfs for writable directories
  • Minimalism: Use distroless or Alpine base images, multi-stage builds
  • Isolation: Apply seccomp profiles, AppArmor/SELinux, namespace restrictions
  • Auditability: Enable content trust, log all container activity

Implementation Steps

Step 1: Harden the Dockerfile

dockerfile
# Use specific digest for reproducibility
FROM python:3.12-slim@sha256:abc123... AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

# Production stage - minimal image
FROM gcr.io/distroless/python3-debian12

# Copy only necessary artifacts
COPY --from=builder /root/.local /root/.local
COPY --from=builder /app /app

WORKDIR /app

# Create non-root user
USER 65534:65534

# Set read-only filesystem expectation
LABEL org.opencontainers.image.source="https://github.com/org/app"

ENTRYPOINT ["python", "app.py"]

Step 2: Harden Docker Daemon Configuration

json
{
  "icc": false,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    },
    "nproc": {
      "Name": "nproc",
      "Hard": 1024,
      "Soft": 1024
    }
  },
  "seccomp-profile": "/etc/docker/seccomp-default.json",
  "tls": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "tlsverify": true
}

Step 3: Harden Container Runtime

bash
docker run -d \
  --name production-app \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=100m \
  --tmpfs /var/run:rw,noexec,nosuid,size=10m \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  --security-opt seccomp=/etc/docker/seccomp-default.json \
  --security-opt apparmor=docker-default \
  --pids-limit 100 \
  --memory 512m \
  --memory-swap 512m \
  --cpus 1.0 \
  --user 65534:65534 \
  --network custom-bridge \
  --restart on-failure:3 \
  --health-cmd "curl -f http://localhost:8080/health || exit 1" \
  --health-interval 30s \
  --health-timeout 10s \
  --health-retries 3 \
  myapp:latest

Step 4: Enable Docker Content Trust

bash
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://notary.example.com

# Sign and push image
docker trust sign myregistry.com/myapp:v1.0.0

# Verify image signature before pull
docker trust inspect --pretty myregistry.com/myapp:v1.0.0

Step 5: Configure Host-Level Auditing

bash
# Add audit rules for Docker files and directories
cat >> /etc/audit/rules.d/docker.rules << 'EOF'
-w /usr/bin/docker -k docker
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /lib/systemd/system/docker.service -k docker
-w /lib/systemd/system/docker.socket -k docker
-w /etc/default/docker -k docker
-w /etc/docker/daemon.json -k docker
-w /usr/bin/containerd -k docker
-w /usr/bin/runc -k docker
EOF

systemctl restart auditd

Validation Commands

bash
# Run Docker Bench Security
docker run --rm --net host --pid host \
  --userns host --cap-add audit_control \
  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
  -v /etc:/etc:ro \
  -v /usr/bin/containerd:/usr/bin/containerd:ro \
  -v /usr/bin/runc:/usr/bin/runc:ro \
  -v /usr/lib/systemd:/usr/lib/systemd:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  docker/docker-bench-security

# Lint Dockerfile
hadolint Dockerfile

# Lint built image
dockle myapp:latest

# Verify no containers running as root
docker ps -q | xargs docker inspect --format '{{.Id}}: User={{.Config.User}}'

Key Security Controls

Control Implementation CIS Section
Non-root user USER instruction in Dockerfile 4.1
Read-only rootfs --read-only flag 5.12
Drop capabilities --cap-drop ALL 5.3
Resource limits --memory, --cpus, --pids-limit 5.10
No new privileges --security-opt no-new-privileges 5.25
Content trust DOCKER_CONTENT_TRUST=1 4.5
TLS for daemon daemon.json TLS config 2.6
Audit logging auditd rules 1.1

References

Recommended Agent Skills

Expand your agent's capabilities with these related and highly-rated skills.

autohandai/community-skills

mapping-mitre-attack-techniques

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.

0 0
Explore
autohandai/community-skills

hunting-for-spearphishing-indicators

Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.

0 0
Explore
autohandai/community-skills

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat

0 0
Explore
autohandai/community-skills

implementing-zero-standing-privilege-with-cyberark

Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.

0 0
Explore
autohandai/community-skills

implementing-pam-for-database-access

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential vaulting, query auditing, dynamic credentia

0 0
Explore
autohandai/community-skills

detecting-t1003-credential-dumping-with-edr

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

0 0
Explore

Didn't find tool you were looking for?

Be as detailed as possible for better results