Best Practices for Docker Security and Configuration

• Correct Ownership to root:docker
• Enable User Namespace Remapping
• Limit Network Exposure
• Mount Filesystem as read-only
• Enabling Live Restore
• Configure CPU and Memory Limitations
• Configure Health Check
• Configure Auditing

Correct Ownership to root:docker

The Docker socket file grants full administrative control over the Docker daemon. Misconfigured ownership increases the risk of privilege escalation and unauthorized access. By ensuring proper ownership (root:docker), only trusted users (system administrators and those in the docker group) can interact with the Docker daemon.

To correct the ownership of the Docker socket file to root:docker:

1. Verify the current ownership.
   Run: 

   ls -l /var/run/docker.sock

2. Change the ownership to root:docker.
   Run: 

   sudo chown root:docker /var/run/docker.sock

3. Adjust permissions to restrict access further.
   Run:

   sudo chmod 660 /var/run/docker.sock

   This ensures only the owner and group members can read/write to the socket.

4. (Optional) Add authorized users to the docker group.
   Run:

   sudo usermod -aG docker

5. Validate the changes.
   Run:

   ls -l /var/run/docker.sock

Mount Filesystem as read-only

1. Setting the filesystem to read-only impacts the application since Tomcat, a PCM dependency, needs to create directories and files in the root /tmp directory. To resolve this, /tmp can be configured as an independent volume.
2. If the volume designated for log paths is set to read-only, it will fail to produce log files; therefore, it requires read-write access.
3. When integrated with Sterling B2B Integrator, the archive filesystem must have read-write permissions because PCM utilizes the archive directory to download and process files.

docker run -d \
--read-only \
--name pem_cm_containername \
-v ./keystore.p12:/opt/IBM/config/keystore.p12:ro \
-v $(pwd)/application.yml:/opt/IBM/config/application.yml:ro \
-v $(pwd)/db2jcc4.jar:/opt/IBM/PCM/jars/db2jcc4.jar:ro \
-v $(pwd)/tmp:/tmp \
-v ./community-manager-cm.log:/opt/IBM/PCM/logs/community-manager-cm.log \
-e APP=<profile> \
-e LOGGER_LEVEL=<logger level> \
-e DB_PASS=<db_pass> \
-e NODE_PORT=<container port> \
-e NODE_IP=<ip of the server > \
-p <host port>:<containerport> \
<imagename>

Enable Live Restore

The lack of live restore support increases the risk of service disruptions during planned or unplanned Docker daemon shutdowns. Enabling live restore ensures that containers continue to function during system updates, Docker daemon restarts, or maintenance.

1. Edit the Docker daemon configuration file located at /etc/docker/daemon.json:

   {
    "live-restore": true
    }

2. Apply the configuration changes by restarting Docker.
   Run: 

   systemctl restart docker

3. Verify the live restore status.
   Run: 

   docker info | grep "Live Restore Enabled"

   Ensure that the output is displayed as true.
4. Restart the Docker daemon and verify that running containers continue functioning.
   To restart, run:

   systemctl stop docker

Configure CPU and Memory Limitations

On Linux hosts, if the kernel detects insufficient memory for critical system functions, it begins terminating processes to free up memory. This may cause the entire system to crash if a critical process is terminated. As a result, it is important not to allow a running container to consume too much of the host machines memory.

Docker allows you to set the amount of CPU or memory a container can use by specifying runtime configuration flags with the docker run command. Setting these limits will prevent the container from using excessive memory of the host machine.

• Run the following command to check the resource utilization of a running container:

  sudo docker stats <container_name>

• Run the following command to set the resource limits during runtime:

  docker run --memory="2g" --cpus="2"

Configure Health Check

Add a health check to container configurations to monitor their runtime state. Without a configured health check, Docker cannot automatically detect or recover from unhealthy states, potentially impacting service reliability. Adding a health check ensures proactive monitoring of container health and enables automated actions like restarting unhealthy containers to minimize service disruption.

Run the command:

docker run -d \
--name pcm1 \
--health-cmd=""curl -s -o /dev/null -w ""%
{http_code}

"" --insecure https://localhost:$NODE_PORT/ | grep -q 200 && echo ""0"" || exit 1"" \
--health-interval=30s \
--health-timeout=10s \
--health-retries=1 \
--health-start-period=50s \
<image>

Configure Auditing

Docker provides detailed logging for its daemon activities. To enable logging:

1. Enable Docker Daemon Logging by adding the following docker logging configuration to the daemon.json file located at /etc/docker/daemon.json: 

   {
      "debug": true,
      "log-level": "info",
      "log-driver": "json-file",
      "log-opts": {
          "max-size": "10m",
          "max-file": "3"
      }
   }

2. Restart Docker. 
   Run: 

   sudo systemctl restart docker

3. (Optional) Integrate with Linux Audit Framework (auditd) to monitor Docker related activities.
   Auditd is installed by default on Red Hat Enterprise Linux 7 and later. 
   To manually install auditd, run:

   sudo df install auditd

4. Create rules to audit Docker-related files and binaries. For example:

   • sudo auditctl -w /usr/bin/docker -p rwxa -k docker_audit

   • sudo auditctl -w /var/run/docker.sock -p rwxa -k docker_audit

   Where,
   • w: Specifies the file or directory to watch.
   • p rwxa: Monitors read, write, execute, and attribute changes.
   • k: Adds a key to filter events.
5. View audit logs.
   Run:

   sudo ausearch -k docker_audit

   Or (Optional):

   sudo cat /var/log/audit/audit.log

   Or:

   sudo aureport