Docker security There are three major areas to consider when reviewing Docker security: the intrinsic security of the kernel and its support for namespaces and cgroups; the attack surface of the Docker daemon itself; loopholes in the container configuration profile, either by default, or when customized by users. the “hardening” security features of the kernel and how they interact with containers. Kernel namespaces Docker containers are very similar to LXC containers, and they have similar s

Docker Security Non-events This page lists security vulnerabilities which Docker mitigated, such that processes run in Docker containers were never vulnerable to the bug—even before it was fixed. This assumes containers are run without adding extra capabilities or not run as --privileged. The list below is not even remotely complete. Rather, it is a sample of the few bugs we’ve actually noticed to have attracted security review and publicly disclosed vulnerabilities. In all likelihood, the bugs

search Usage: docker search [OPTIONS] TERM Search the Docker Hub for images --automated Only show automated builds --help Print usage --no-trunc Don't truncate output -s, --stars=0 Only displays with at least x stars Search Docker Hub for images See Find Public Images on Docker Hub for more details on finding shared images from the command line. Note: Search queries will only return up to 25 results Examples Search images by name This example

Docker run reference Docker runs processes in isolated containers. A container is a process which runs on a host. The host may be local or remote. When an operator executes docker run, the container process that runs is isolated in that it has its own file system, its own networking, and its own isolated process tree separate from the host. This page details how to use the docker run command to define the container’s resources at runtime. General form The basic docker run command takes this for

save Usage: docker save [OPTIONS] IMAGE [IMAGE...] Save one or more images to a tar archive (streamed to STDOUT by default) --help Print usage -o, --output="" Write to a file, instead of STDOUT Produces a tarred repository to the standard output stream. Contains all parent layers, and all tags + versions, or specified repo:tag, for each argument provided. It is used to create a backup that can then be used with docker load $ docker save busybox > busybox.tar $ ls -sh bu

run Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...] Run a command in a new container -a, --attach=[] Attach to STDIN, STDOUT or STDERR --add-host=[] Add a custom host-to-IP mapping (host:ip) --blkio-weight=0 Block IO weight (relative weight) --blkio-weight-device=[] Block IO weight (relative device weight, format: `DEVICE_NAME:WEIGHT`) --cpu-shares=0 CPU shares (relative weight) --cap-add=[] Add L

rmi Usage: docker rmi [OPTIONS] IMAGE [IMAGE...] Remove one or more images -f, --force Force removal of the image --help Print usage --no-prune Do not delete untagged parents You can remove an image using its short or long ID, its tag, or its digest. If an image has one or more tag referencing it, you must remove all of them before the image is removed. Digest references are removed automatically when an image is removed by tag. $ docker images REPOSITO

rm Usage: docker rm [OPTIONS] CONTAINER [CONTAINER...] Remove one or more containers -f, --force Force the removal of a running container (uses SIGKILL) --help Print usage -l, --link Remove the specified link -v, --volumes Remove the volumes associated with the container Examples $ docker rm /redis /redis This will remove the container referenced under the link /redis. $ docker rm --link /webapp/redis /webapp/redis This will remove th

restart Usage: docker restart [OPTIONS] CONTAINER [CONTAINER...] Restart a container --help Print usage -t, --time=10 Seconds to wait for stop before killing the container

rename Usage: docker rename [OPTIONS] OLD_NAME NEW_NAME Rename a container --help Print usage The docker rename command allows the container to be renamed to a different name.