Docker Security
Docker security is about the gap between what people assume a container provides and what it actually does. A container is not a strong security boundary by default; a misconfigured one gives an attacker a path straight to the host. The common risks are privileged containers, the exposed Docker socket, untrusted images and secrets baked into layers.
The dangerous assumption
People treat containers as if they fully isolate what runs inside. They do not, by default. A container shares the host kernel, and several common misconfigurations let an attacker inside a container reach the host itself. Understanding that gap is the whole of Docker security.
The common risks
| Risk | Why it is dangerous |
|---|---|
| Privileged containers | Near full host access from inside |
| Mounted Docker socket | Control the Docker daemon, own the host |
| Running as root | Container root can become host root in some setups |
| Untrusted images | Malware or backdoors from a public registry |
| Secrets in image layers | Passwords and keys committed into the image |
The Docker socket, the worst one
Mounting the Docker socket into a container gives that container control over the Docker daemon, and the daemon runs as root on the host. An attacker who reaches such a container can start a new privileged container and take the host. Never mount the socket into a container that processes untrusted input.
Image risks
Pulling a public image runs someone else's code on your infrastructure. Images can contain malware, backdoors or known vulnerable dependencies. And secrets baked into a layer stay in the image history even if a later layer deletes them, so anyone with the image can extract them.
# secrets in layers persist even if deleted later
# scan images and never bake secrets into themHardening
- Do not run containers as root; use a non root user
- Never mount the Docker socket into untrusted containers
- Avoid privileged mode unless genuinely required
- Scan images for vulnerabilities and malware before use
- Keep secrets out of images, inject them at runtime
- Use minimal base images to shrink the attack surface
The mental model: assume a container can be escaped, and design so that escaping one does not hand over the host. Defence in depth, not trust in the container boundary.
Where this fits
Container security is core to DevSecOps and cloud security, since most cloud workloads run in containers. It is a growing, well paid specialisation.
Practise this
Set up a deliberately misconfigured container and practise escaping it to the host, then harden it and try again. Free labs on Hacklido.
Enroll in Cloud Security
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in Cloud Security