domains / families / security / hardening-docker-daemon-configuration

hardening-docker-daemon-configuration

separate

Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and per-container runtime flags - use hardening-docker-containers-for-production.

When to use

• When deploying or configuring hardening docker daemon configuration capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

When not to use

• hardening images
• per-container runtime flags

Skill page

Source