docker-container-securitylisted

# Docker / Container Security A pragmatic baseline for Docker on a single VPS or a small cluster. Covers the Dockerfile, the run-time configuration, and the host-side gotchas — particularly the UFW-bypass that catches most people once. ## When to invoke - Installing Docker on a VPS that has UFW (read the UFW section first — Docker bypasses UFW by default) - Writing a new Dockerfile or `docker-compose.yml` for production - Pushing an image to a public registry - Periodic audit of running containers - After a base-image CVE that affects your stack ## The UFW bypass — read this first Docker manipulates `iptables` directly. By default, **ports published with `-p` are exposed to the world**, even if UFW says they should not be. `ufw status` will mislead you. Two options: **Option A — use `ufw-docker`** (community-maintained, robust): ```bash # Install ufw-docker sudo wget -O /usr/local/bin/ufw-docker \ https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker sudo chmod +x /usr/local/bin/ufw-docker sudo ufw-docker install sudo systemctl restart ufw # Then allow per-container: sudo ufw-docker allow web 80/tcp ``` **Option B — bind to localhost when you front with a reverse proxy**: ```yaml # docker-compose.yml — bind to 127.0.0.1, not 0.0.0.0 services: app: ports: - "127.0.0.1:9000:9000" # host nginx proxies to this ``` Verify: ```bash sudo ss -tlnp | grep docker # should not show 0.0.0.0:<port> for internal services ``` ## Dockerfile baseline