Docker Container Security Hardening: 8-Layer Defense from Image to Runtime in 2026

DevOps

Are Your Containers Really Secure?

Containerized deployment speeds up delivery, but security debt accumulates fast. Default Docker containers run as root, mount the Docker Socket, and have no resource limits—once an attacker breaks out of the container boundary, they gain host root privileges. Supply chain attacks are frequent, malicious images infiltrate production; sensitive information leaks through environment variables; runtime privilege escalation vulnerabilities get exploited... These aren't hypothetical scenarios—they're security incidents happening every day.

In 2026, container security has shifted from "optional" to "mandatory." This article builds an 8-layer defense system, from image building to runtime protection, leaving no blind spots in container security.

8-Layer Defense System Overview

Layer Defense Target Core Technology
Layer 1 Image Security Multi-stage builds, distroless, image scanning
Layer 2 Supply Chain Security Image signing, SBOM, immutable tags
Layer 3 Least Privilege Non-root user, read-only filesystem, capability trimming
Layer 4 Network Isolation Network policies, Service Mesh, egress control
Layer 5 Resource Limits CPU/memory limits, PIDs limit, OOM policy
Layer 6 Syscall Filtering Seccomp profiles, AppArmor policies
Layer 7 Runtime Monitoring Vulnerability detection, anomaly alerts, file integrity
Layer 8 Compliance Audit CIS benchmarks, security baselines, audit logs

Deep Analysis: 8 Major Container Security Threats

Threat Attack Path Impact Defense Layer
Malicious base image Supply chain poisoning All containers Layer 1-2
Container escape Kernel vulnerability exploitation Host Layer 3-6
Privilege escalation Root + excessive capabilities Host Layer 3
Lateral movement No network isolation All cluster services Layer 4
Resource exhaustion No resource limits All containers on node Layer 5
Sensitive data leak Env vars / config files Data breach Layer 3
Supply chain tampering Image tag override All containers Layer 2
Runtime attack Known vulnerability exploitation In-container services Layer 7

Layer 1: Image Security

Multi-stage Build + Distroless

# Build stage
FROM golang:1.23-alpine AS builder

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w -X main.version=1.0.0" \
    -o /app/server .

# Runtime stage - distroless
FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=builder /app/server /server
COPY --from=builder /app/configs /configs

USER 65532:65532

ENTRYPOINT ["/server"]

Image Scanning

# Scan with Trivy
trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/app:v1.0.0

# CI/CD integration
trivy image --format json --output trivy-report.json registry.example.com/app:v1.0.0

# Scan with Grype
grype registry.example.com/app:v1.0.0 --fail-on critical

# Docker Scout
docker scout cves registry.example.com/app:v1.0.0
docker scout recommendations registry.example.com/app:v1.0.0

Layer 2: Supply Chain Security

Image Signing & Verification

# Sign image with cosign
cosign sign --key cosign.key registry.example.com/app:v1.0.0

# Verify signature
cosign verify --key cosign.pub registry.example.com/app:v1.0.0

SBOM Generation

# Generate SBOM with syft
syft registry.example.com/app:v1.0.0 -o spdx-json > sbom.json

# Generate with Docker Scout
docker scout sbom registry.example.com/app:v1.0.0

Immutable Tags

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-image-tag
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: "Images must use specific version tags, latest is not allowed"
        pattern:
          spec:
            containers:
              - image: "!*:latest"

Layer 3: Least Privilege

Secure Dockerfile

FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .

FROM node:20-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY --from=builder --chown=appuser:appgroup /app .

USER appuser

RUN mkdir -p /app/data && chown appuser:appgroup /app/data
VOLUME ["/app/data"]

HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

EXPOSE 3000
CMD ["node", "server.js"]

Secure docker-compose.yml

version: "3.9"

services:
  app:
    image: registry.example.com/app:v1.0.0
    security_opt:
      - no-new-privileges:true
      - seccomp:seccomp-profile.json
      - apparmor:docker-apparmor-profile
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
      - /run:noexec,nosuid,size=10m
    user: "65534:65534"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
          pids: 100
        reservations:
          cpus: "0.25"
          memory: 128M
    networks:
      - app-network
    volumes:
      - app-data:/app/data:noexec

networks:
  app-network:
    driver: bridge
    internal: true

volumes:
  app-data:

Layer 4: Network Isolation

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-app
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 3000
          protocol: TCP
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
      ports:
        - port: 5432
          protocol: TCP
    - to: []
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP

Layer 5: Resource Limits

apiVersion: v1
kind: LimitRange
metadata:
  name: production-limits
  namespace: production
spec:
  limits:
    - default:
        cpu: "500m"
        memory: "256Mi"
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"
      max:
        cpu: "2"
        memory: "2Gi"
      min:
        cpu: "50m"
        memory: "64Mi"
      type: Container

Layer 6: Syscall Filtering

Seccomp Profile

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "defaultErrnoRet": 1,
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_AARCH64"],
  "syscalls": [
    {
      "names": [
        "accept", "access", "bind", "brk", "close", "connect",
        "dup", "dup2", "epoll_create", "epoll_ctl", "epoll_wait",
        "exit", "exit_group", "fcntl", "fstat", "futex", "getcwd",
        "getdents64", "getegid", "geteuid", "getgid", "getpid",
        "getppid", "getsockname", "getuid", "ioctl", "listen",
        "lseek", "mmap", "mprotect", "munmap", "nanosleep",
        "open", "openat", "pipe", "poll", "read", "recvfrom",
        "recvmsg", "sendmsg", "sendto", "setgid", "setgroups",
        "setuid", "socket", "stat", "write"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

AppArmor Profile

#include <tunables/global>

profile docker-apparmor flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

  network inet tcp,
  network inet udp,

  /app/** r,
  /app/data/** rw,
  /tmp/** rw,

  deny /proc/*/mem rw,
  deny /sys/** rw,
  deny /etc/shadow r,

  capability net_bind_service,
  capability setgid,
  capability setuid,

  deny capability sys_admin,
  deny capability sys_ptrace,
}

Layer 7: Runtime Monitoring

apiVersion: falco.org/v1
kind: FalcoRule
metadata:
  name: container-security-rules
spec:
  rules:
    - rule: Container drifted from image
      desc: Detect container process not in original image
      condition: >
        container and proc.is_v1 and not proc.name in (container.image.repository)
      output: >
        Drift detected (container=%container.name image=%container.image.repository)
      priority: WARNING

    - rule: Read sensitive file
      desc: Detect reading of sensitive files
      condition: >
        container and open_read and fd.name in (/etc/shadow, /etc/passwd, /root/.ssh/id_rsa)
      output: >
        Sensitive file read (container=%container.name file=%fd.name)
      priority: CRITICAL

Layer 8: Compliance Audit

# CIS Docker Benchmark audit
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  docker/docker-bench-security

# Kubernetes audit with kube-bench
kube-bench run --targets master,node,etcd,policies

# Docker daemon security config
cat > /etc/docker/daemon.json << 'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "userns-remap": "default",
  "no-new-privileges": true
}
EOF

Pitfall Guide

Pitfall 1: Rootless Mode Volume Permission Errors

Rootless mode maps container UIDs to host sub-UID ranges, causing mount permission issues.

Solution: Check sub-UID ranges with cat /etc/subuid, adjust volume permissions, or use :Z label.

Pitfall 2: Seccomp Too Strict Crashes App

Default deny-all blocks syscalls the application needs.

Solution: Use strace to collect required syscalls, temporarily disable with --security-opt seccomp=unconfined for debugging, start permissive and tighten gradually.

Pitfall 3: AppArmor Config Not Taking Effect

AppArmor profile not loaded or Docker not recognizing it.

Solution: Check with aa-status, manually load with apparmor_parser -r, confirm Docker uses it.

Pitfall 4: Read-Only Filesystem Write Failures

read_only: true prevents apps from writing temp files or cache.

Solution: Add tmpfs mounts and volumes for writable paths.

Pitfall 5: Too Many False Positives in Image Scanning

Scanner reports many low-severity vulnerabilities, drowning real issues.

Solution: Focus on HIGH and CRITICAL only, configure .trivyignore, use VEX documents.

Error Troubleshooting

# Error Message Cause Solution
1 permission denied while trying to connect to the Docker daemon socket User not in docker group sudo usermod -aG docker $USER
2 OCI runtime create failed: rootfs propagation error Rootless mount conflict Check volume paths and UID mapping
3 seccomp: unknown syscall Missing syscall in Seccomp config Add missing syscall to allowlist
4 AppArmor: denied AppArmor policy blocking operation Update AppArmor profile
5 write /proc/self/attr/current: permission denied no-new-privileges + SELinux conflict Adjust SELinux policy
6 read-only file system Write on read-only root Add tmpfs or volume mounts
7 OOMKilled Memory limit too small Increase memory limit
8 certificate verify failed Registry cert verification failed Configure trusted certs
9 image signature verification failed Image signature verification failed Confirm cosign signing and public key
10 no space left on device Too many image layers Run docker system prune -a

Advanced Optimization

1. Rootless Docker Deployment

dockerd-rootless-setuptool.sh install
echo "export DOCKER_HOST=unix:///run/user/$UID/docker.sock" >> ~/.bashrc
docker info | grep -i rootless

2. Build-Sign-Scan CI Pipeline

name: Build and Sign Image
on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t registry.example.com/app:${{ github.ref_name }} .
      - name: Scan image
        run: trivy image --exit-code 1 --severity HIGH,CRITICAL registry.example.com/app:${{ github.ref_name }}
      - name: Sign image
        uses: sigstore/cosign-installer@v3
      - run: cosign sign --yes --key env://COSIGN_KEY registry.example.com/app:${{ github.ref_name }}

3. Automated Runtime Security Policies

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pod-security-defaults
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-non-root
      match:
        resources:
          kinds: [Pod]
      validate:
        message: "Containers must run as non-root"
        pattern:
          spec:
            containers:
              - securityContext:
                  runAsNonRoot: true
    - name: drop-all-capabilities
      match:
        resources:
          kinds: [Pod]
      mutate:
        patchStrategicMerge:
          spec:
            containers:
              - (name): "?*"
                securityContext:
                  capabilities:
                    drop:
                      - ALL

Comparison Analysis

Dimension Docker Default CIS Level 1 CIS Level 2 Rootless Podman
Runs as root Yes No No No No
Capability trimming None drop ALL drop ALL + min add Auto-limited Auto-limited
Read-only filesystem No Recommended Enforced No No
Seccomp Default Default Custom Default Default
AppArmor None Recommended Enforced None None
Image scanning None Recommended Enforced Recommended Recommended
Image signing None None Recommended Recommended Recommended
Network isolation None Recommended Enforced Recommended Recommended
Resource limits None Recommended Enforced Recommended Recommended
Audit logging None Recommended Enforced Recommended Recommended
Security level Low Medium High High High
Compatibility risk None Low Medium Medium Medium

Summary: Docker container security is not a single technology but a systematic 8-layer defense-in-depth system. From multi-stage builds and vulnerability scanning at the image stage, to Seccomp/AppArmor policies and Falco monitoring at runtime, each layer reduces the attack surface. Best practices for 2026: default non-root, read-only filesystem, minimal capabilities, image signature verification, and continuous vulnerability scanning. Start with CIS Level 1 baseline, gradually upgrade to Level 2, and ultimately achieve Rootless deployment. Security has no finish line—only continuous improvement.

  • JSON Formatter: /en/json/format — Format Seccomp configs and Docker API responses
  • Base64 Encode/Decode: /en/encode/base64 — Encode/decode Docker Registry auth tokens and Secrets
  • Curl to Code: /en/dev/curl-to-code — Convert Docker API debug curl to code

Try these browser-local tools — no sign-up required →

#Docker#容器安全#镜像扫描#Rootless#Seccomp#AppArmor#供应链安全#CIS基准