Hardening & Confinement

The scanner inventories everything installed in the image (OS packages per layer plus app dependencies), determines each component's name and version, then matches those against vulnerability databases (like the NVD and distro advisories). Matches are reported as CVEs with severities. It is metadata matching, not runtime analysis.

The Docker daemon runs as root and docker group members can talk to its socket. One container that bind-mounts the host filesystem gives them full root. Offer rootless Docker, Podman, or a narrow sudo rule instead.

Build arguments are recorded in the image's build history, and any ENV keeps the value in image config. Anyone who pulls the image can read them with docker history or docker inspect, or by unpacking the saved image — and deleting a file later does not remove earlier layers.

By default the container process runs as UID 0, the same UID 0 the host kernel calls root. A USER instruction runs it as an unprivileged UID, so escapes, bind mounts and host files get no root rights. It is defence in depth, not isolation.

Upgrading OS packages inside a Dockerfile makes the image depend on when it was built, its cached instruction stops re-running so it patches nothing, and the superseded files stay in the layers below. Rebuild on a refreshed base instead.

Capabilities split root's power into ~40 separate privileges. Docker grants a default subset of 14 (CHOWN, SETUID, NET_RAW, NET_BIND_SERVICE and others) rather than all. --cap-drop ALL removes them all; --cap-add NET_BIND_SERVICE then adds back only what the workload needs.

Bind-mounting the host root gives the container's root user read-write access to every host file. It can append an SSH key, edit /etc/passwd or sudoers, or drop a cron/systemd unit -- arbitrary code execution as root on the host, with no kernel exploit and no --privileged needed.

--read-only mounts the container's root filesystem read-only, so every write to a path that came from the image fails with EROFS. Mounts are unaffected: volumes, bind mounts and tmpfs stay writable, so scratch paths such as /tmp and /run need an explicit --tmpfs.

Rootless mode runs the daemon as an ordinary user inside a user namespace. Ranges in /etc/subuid and /etc/subgid, applied by the setuid helper newuidmap, map container uid 0 to a high unprivileged host uid — which is what host files end up owned by.

A secret mount exposes the value as a temporary in-memory file, mounted only for that one RUN instruction. It is not written to any layer and its value never appears in the image history. It still leaks if the command copies it into the filesystem or prints it.

The daemon runs as root and its API can create a container that bind-mounts the host's / and runs privileged. From inside that container an attacker chroots into the host filesystem or writes to it, gaining full root. The socket is a root-equivalent control plane, not a limited API.

Gate on severity thresholds plus fixability: typically fail on CRITICAL/HIGH that have a fix available, and don't block on unfixable ones (report them). Handle noise with a reviewed, time-boxed allow-list (e.g. .trivyignore / VEX) that documents why each CVE is ignored and expires, so exceptions get revisited rather than becoming permanent.

Environment values show up in docker inspect, are inherited by every child process, are readable in /proc/<pid>/environ, and get captured by crash and error reporters. A file can be permission-scoped, stays out of inspect output, and can be rotated in place. Prefer a mounted file, ideally on tmpfs.

docker build --pull makes the builder re-resolve every FROM reference against the registry instead of reusing the base image already in the host's local image store. Without it a rebuild can inherit a months-old base, and its CVEs, forever.

It is the Unix socket the root Docker daemon listens on for its REST API. Bind-mounting it lets a container send API calls to the host daemon (run, build, exec, mount, inspect), so it can control every container on that host.

It sets the kernel's no_new_privs bit on the container process, which is inherited by all children and cannot be unset. With it, executing a setuid binary or a file with file capabilities grants no extra privilege, so a compromised unprivileged process cannot escalate that way.

Plain TCP on port 2375 is unauthenticated and unencrypted; anyone who can reach it gets root-equivalent daemon control, and internet scanners actively hunt for it. Expose remotely only over port 2376 with TLS mutual authentication (verify client certs), or better, tunnel over SSH (DOCKER_HOST=ssh://).

Each drops one isolation boundary: --pid=host reveals and lets the container signal every host process, --net=host puts it directly on the host's network stack, and --ipc=host shares host shared memory. All three erode container-host isolation and need no --privileged to be dangerous.

--pids-limit sets the container cgroup's pids.max, capping every process and thread inside that one container; further clone() calls fail with EAGAIN. --ulimit nproc sets a per-UID kernel limit counted across the whole host, so it is the weaker and more surprising control.

An SBOM is a machine-readable inventory of every component and version in an image (formats: SPDX, CycloneDX). You generate it once at build time; then you can re-scan that list against fresh CVE feeds anytime without the image, and detect newly-disclosed CVEs in components you already shipped. Direct scanning re-inventories the image each run.

Move the listener to a high port and publish 80 on the host, or grant CAP_NET_BIND_SERVICE. For writes, chown the needed directories to the UID at build time, redirect state to /tmp, and mount tmpfs or a named volume for anything else.

The daemon puts containers in their own user namespace. Inside, the process still sees UID 0; the kernel maps that to an unprivileged host UID from a subordinate range in /etc/subuid and /etc/subgid, typically belonging to a user named dockremap.

A tag is a mutable pointer, and the host already holds an image under that name, so docker run, docker compose up and docker restart never ask the registry. Only a pull plus a container recreate lands the rebuild.

seccomp is a kernel syscall filter. Docker applies a default JSON profile that allows most syscalls and returns EPERM for a few dozen dangerous ones (mount, reboot, kexec_load, keyctl, add_key, and namespace-creating clone flags). If an app breaks, identify the denied syscall and write a narrow custom profile — never use seccomp=unconfined in production.

Socket-mount reuses the host daemon: fast and cache-sharing, but the job gets host root and can see sibling containers, so it's unsafe for untrusted/shared runners. DinD runs a private daemon per job (needs privileged): stronger isolation and clean caches, but privileged is its own risk and caches are cold. Rootless builders (BuildKit/Kaniko/Buildah) avoid both.

Put a small proxy (e.g. tecnativa/docker-socket-proxy) in front of the real socket. It exposes the Engine API over a network port but allow-lists only the endpoints the client needs, usually read-only GETs like /containers and /events, and denies container create, exec, and image mutations. The agent connects to the proxy, never to the raw socket.

With CAP_SYS_ADMIN (which --privileged grants) on a cgroup v1 host, the container mounts a cgroup hierarchy, sets its release_agent to a script on a host-visible path, and empties a child cgroup. The kernel then runs that script as root in the host namespace -- a full breakout, needing no CVE.

Run the container once without --read-only, exercise it fully, then read docker diff to list every file it changed in its writable layer. Classify each path: sized tmpfs for scratch, a named volume for durable state, and move one-time startup writes into the image.

New CVEs are disclosed continuously against packages already baked into your image, and a passing build only reflects the feed on build day. Fix it by rebuilding regularly (scheduled/nightly), pinning base images by digest but bumping them on a cadence, using minimal/distroless bases to shrink the surface, and re-scanning deployed images so new CVEs trigger a rebuild.