docker-container-security

Docker / Container Security

A pragmatic baseline for Docker on a single VPS or a small cluster. Covers the Dockerfile, the run-time configuration, and the host-side gotchas — particularly the UFW-bypass that catches most people once.

When to invoke

• Installing Docker on a VPS that has UFW (read the UFW section first — Docker bypasses UFW by default)
• Writing a new Dockerfile or docker-compose.yml for production
• Pushing an image to a public registry
• Periodic audit of running containers
• After a base-image CVE that affects your stack

The UFW bypass — read this first

Docker manipulates iptables directly. By default, ports published with -p are exposed to the world, even if UFW says they should not be. ufw status will mislead you.

Two options:

Option A — use ufw-docker (community-maintained, robust):

# Install ufw-docker
sudo wget -O /usr/local/bin/ufw-docker \
  https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
sudo chmod +x /usr/local/bin/ufw-docker
sudo ufw-docker install
sudo systemctl restart ufw

# Then allow per-container:
sudo ufw-docker allow web 80/tcp

Option B — bind to localhost when you front with a reverse proxy:

# docker-compose.yml — bind to 127.0.0.1, not 0.0.0.0
services:
  app:
    ports:
      - "127.0.0.1:9000:9000"   # host nginx proxies to this

Verify:

sudo ss -tlnp | grep docker     # should not show 0.0.0.0:<port> for internal services

Dockerfile baseline

Every production Dockerfile should:

1. Run as a non-root user
2. Pin the base image to a specific digest or version tag (not latest)
3. Drop build tools from the final image
4. Not contain secrets baked in

# Pin to specific Node version; consider digest pinning for stricter supply chain
FROM node:20.11.1-bookworm-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

FROM node:20.11.1-bookworm-slim
WORKDIR /app

# Create non-root user
RUN groupadd -r app && useradd -r -g app -d /app -s /sbin/nologin app

COPY --from=deps /app/node_modules ./node_modules
COPY --chown=app:app . .

USER app
EXPOSE 3000

# Use exec form so the process becomes PID 1 and receives signals
CMD ["node", "server.js"]