Docker security basics for small teams

Docker makes deploying applications easy, and that is exactly why insecure defaults spread so fast. A container that runs as root with a port open to the whole internet and an image from two years ago is a common sight. These steps fix the most frequent issues.

Step 1. Publish only what is needed, preferably on localhost

Bind application ports to 127.0.0.1 and put a reverse proxy (nginx, Traefik) in front with HTTPS. Databases and admin tools should not be published at all.

# docker-compose.yml – publish only on localhost, behind the reverse proxy
services:
  app:
    image: myapp:1.4.2
    ports:
      - "127.0.0.1:8080:80"

Step 2. Do not run as root

Use a non-root user in the image. Many official images already provide one.

# Dockerfile
FROM node:22-slim
WORKDIR /app
COPY . .
RUN npm ci --omit=dev
USER node
CMD ["node", "server.js"]

Step 3. Reduce what the container is allowed to do

A read-only filesystem, no Linux capabilities and no privilege escalation limit the damage if the application is compromised. Keep secrets in .env files or secret stores, never in the image, and never mount the Docker socket into containers you do not fully trust.

services:
  app:
    image: myapp:1.4.2
    read_only: true
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    env_file: .env

Step 4. Update images regularly

Use specific version tags, rebuild and pull updated images on a schedule, and remove old ones. Scan images for known vulnerabilities as part of the build.

docker compose pull
docker compose up -d
docker image prune -f

A container is a box, not a safe. What matters is what is inside and who can open it.

Need help with this? Contact CySec for a free consultation.

All articles