Docker security best practices

Docker adds isolation, but it does not remove the need for security. A few rules greatly reduce the risks.

1. Use official, pinned images

Prefer official images and pin the version (not latest), so you know exactly what you run:

image: postgres:16.2

2. Do not run as root in the container

Many images allow a non-root user. In the Dockerfile:

USER appuser

3. Do not put secrets in the image

Passwords and keys go through environment variables or .env files, never written directly into the image or into git.

4. Limit resources

Stop a container from consuming the whole server:

docker run --memory=512m --cpus=1 the_image

5. Do not expose the Docker port

Never expose the Docker socket or API port to the internet, it is equivalent to root access on the server.

6. Update images

docker compose pull && docker compose up -d

Combine with a firewall on the server for defense in depth.