Docker Container Security: Harden and Scan Images

Partly. Docker applies a default seccomp profile, drops many capabilities, and isolates processes with namespaces. But containers still share the host kernel, run as root unless you change it, and can leak secrets baked into image layers, so you must harden images and runtime settings yourself.

If an attacker gets code execution in a root container, they hold root inside it and have a much easier path to escape to the host. A non-root user with all capabilities dropped limits what a compromised process can read, write, or reconfigure.

No. Every instruction creates a layer, and earlier layers keep their contents even if a later layer hides the file. Use BuildKit secret mounts for build-time secrets and inject runtime secrets from your orchestrator.

Scan on every build before pushing, and rescan images already in your registry on a schedule. New CVEs are published daily, so an image that was clean last month can be vulnerable today.