Container Security: Hardening the Docker Daemon

Docker containers share the host machine’s kernel. Misconfigurations in the Docker daemon can lead to complete host compromise.

1. Run Containers as Non-Root

By default, containers execute as the root user. Always enforce a non-root user account inside your `Dockerfile`:

USER node

2. Restrict Sockets Access

The Docker socket `/var/run/docker.sock` allows full control over the daemon. Never expose this socket inside container volumes, as it allows escape to host root.

3. Limit Container Resources

Configure CPU and memory limits to prevent Denial of Service (DoS) memory exhaust attacks:

docker run --memory="512m" --cpus="1.0" my_app