Docker Rootless Mode Security Hardening Checklist

Short summary

Docker containers run as root by default, creating critical security risks from container escapes. Rootless mode (Docker 20.10+) runs the daemon as an unprivileged user, dramatically reducing blast radius. This checklist covers 13 essential steps—including often-missed configurations like loginctl lingering and explicit DOCKER_HOST setting—plus kernel and networking requirements.

• •Default Docker daemon runs as root; container escape equals full host compromise
• •Rootless mode maps UID 0 to unprivileged user via Linux namespaces, reducing escalation risk
• •13-step hardening checklist with often-missed configurations: loginctl lingering, DOCKER_HOST, cgroup v2 delegation, and sysctl tuning

Generated with AI, which can make mistakes.