zakirkun Insecure Docker Configuration
Overview
Docker misconfiguration can lead to container escapes and privilege escalation:
--privilegedflag: Gives container full host capabilities, enabling container escape- Running as root: Default behavior — prefer non-root user
- Secrets in ENV variables: Visible via
docker inspectand process listings --cap-add=SYS_ADMIN: Grants dangerous capabilities- Mounting Docker socket: Allows container to control the host Docker daemon
--pid=host: Shares host PID namespace
Remediation
- Add
USER nonrootin Dockerfile - Use Docker secrets or env files for sensitive values
- Remove unnecessary capabilities with
--cap-drop ALL --cap-addonly what's needed - Never mount
/var/run/docker.sockunless strictly necessary - Enable Docker Content Trust