# OWASP Docker Security Cheat Sheet

**URL:** <https://forums.docker.com/t/owasp-docker-security-cheat-sheet/137987>\
**Category:** General\
**Tags:** security, tutorial, tips\
**Created:** [October 6, 2023, 11:37am UTC](https://forums.docker.com/t/owasp-docker-security-cheat-sheet/137987 "2023-10-06T11:37:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bluepuma77](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/bluepuma77/32/32688_2.png) [@bluepuma77](https://forums.docker.com/u/bluepuma77)\
**Post date:** [October 6, 2023, 11:37am UTC](https://forums.docker.com/t/owasp-docker-security-cheat-sheet/137987/1 "2023-10-06T11:37:07Z")

</div>

Just found this, it’s a must read for everyone connecting containers to the Internet.

> The aim of this cheat sheet is to provide an easy to use list of common security mistakes and good practices that will help you secure your Docker containers.

1. [Keep Host and Docker up to date](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-0-keep-host-and-docker-up-to-date)
2. [Do not expose the Docker daemon socket (even to the containers)](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)
3. [Set a user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)
4. [Limit capabilities (Grant only specific capabilities, needed by a container)](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-3-limit-capabilities-grant-only-specific-capabilities-needed-by-a-container)
5. [Add –no-new-privileges flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)
6. [Disable inter-container communication (–icc=false)](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-5-disable-inter-container-communication-iccfalse)
7. [Use Linux Security Module (seccomp, AppArmor, or SELinux)](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-6-use-linux-security-module-seccomp-apparmor-or-selinux)
8. [Limit resources (memory, CPU, file descriptors, processes, restarts)](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-7-limit-resources-memory-cpu-file-descriptors-processes-restarts)
9. [Set filesystem and volumes to read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)
10. [Use static analysis tools](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-9-use-static-analysis-tools)
11. [Set the logging level to at least INFO](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-10-set-the-logging-level-to-at-least-info)
12. [Lint the Dockerfile at build time](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-11-lint-the-dockerfile-at-build-time)

Source: [Docker Security - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)

---

<div class="post-metadata">

**Author:** ![rimelek](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/rimelek/32/41602_2.png) [@rimelek](https://forums.docker.com/u/rimelek)\
**Post date:** [October 6, 2023, 11:46am UTC](https://forums.docker.com/t/owasp-docker-security-cheat-sheet/137987/2 "2023-10-06T11:46:20Z")

</div>

Thank you for sharing it! I think it fits into Tips & HowTos so I moved the topic to that category.