Docker host security baseline reminders
Overview
Docker hosts are multi-tenant condensation points—daemon socket exposure equals root everywhere.
Baseline
- Latest supported engine; user namespaces / rootless where workloads allow.
- TLS for remote API; SSH bastion only—no 2375/tcp public ever.
- AppArmor/SELinux profiles per distro defaults enforced, not permissive “to move ticket.”
Images
Pull only from trusted registries; scan CI; read-only rootfs where possible; drop CAP_SYS_ADMIN fantasies.
Logging
Forward container logs to SIEM with namespace labels; Docker events for create/exec alerts.
Upgrades
Swarm/Kubernetes version skew matrices—blind docker-ce bump breaks orchestration—read release notes.
Incident
docker ps rogue --privileged container: isolate host from network, snapshot disk, forensics playbook.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...