Docker interview question · Most asked
How do you secure Docker containers and images?
Summary
Use minimal, regularly rebuilt base images from trusted sources; scan images for vulnerabilities in CI and registries; sign images and verify signatures; run as non-root; drop capabilities (--cap-drop ALL); use a read-only root filesystem; set resource limits; never mount the Docker socket into containers; and keep secrets out of images.
Longer Answer
Additional measures: keep Docker Engine and the host kernel patched; use rootless Docker or user namespaces to reduce the impact of escapes; apply the default seccomp and AppArmor/SELinux profiles (never --privileged unless unavoidable); generate SBOMs; and restrict who can access the Docker daemon, because access to it (or its socket) is effectively root on the host.
Key Points
- Minimal trusted images; scan and sign.
- Non-root, drop capabilities, read-only FS.
- Never mount docker.sock; no --privileged.
- Daemon access = root.
More most-asked Docker questions
- What is the difference between an image and a container, and how do image layers work?
- What is a container, and how does it differ from a virtual machine?
- What are multi-stage builds, and why use them?
- CMD or ENTRYPOINT: what is the difference, and what are exec and shell forms?
- How does Docker build caching work, and how do you order a Dockerfile to use it well?
- What are Dockerfile best practices for production images?
- ARG or ENV: what is the difference, and how do you pass secrets into a build safely?
- Why does PID 1 matter in containers, and what problems can it cause?