What it does. Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and per-container runtime flags - use hardening-docker-containers-for-production. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/hardening-docker-daemon-configuration/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hardening-docker-daemon-configuration, or copy the skill folder into ~/.claude/skills/hardening-docker-daemon-configuration/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/SKILL.md

SKILL.md (verbatim)

name: hardening-docker-daemon-configuration
description: >-
  Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace
  remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls
  such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon
  to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon
  settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap,
  no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and
  per-container runtime flags - use hardening-docker-containers-for-production.
domain: cybersecurity
subdomain: container-security
tags:
- docker
- daemon-hardening
- container-security
- cis-benchmark
- rootless
- userns-remap
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525
- T1553

Hardening Docker Daemon Configuration

Overview

The Docker daemon (dockerd) runs with root privileges and controls all container operations. Hardening its configuration through /etc/docker/daemon.json, TLS certificates, user namespace remapping, and network restrictions is essential to prevent privilege escalation, lateral movement, and container breakout attacks.

When to Use

• When deploying or configuring hardening docker daemon configuration capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Docker Engine 24.0+ installed
• Root or sudo access to the Docker host
• OpenSSL for TLS certificate generation
• Understanding of Linux namespaces and cgroups

Core Hardened daemon.json

{
  "icc": false,
  "userns-remap": "default",
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  },
  "storage-driver": "overlay2",
  "live-restore": true,
  "userland-proxy": false,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 65536,
      "Soft": 32768
    },
    "nproc": {
      "Name": "nproc",
      "Hard": 4096,
      "Soft": 2048
    }
  },
  "seccomp-profile": "/etc/docker/seccomp/default.json",
  "default-address-pools": [
    {
      "base": "172.17.0.0/16",
      "size": 24
    }
  ],
  "iptables": true,
  "ip-forward": true,
  "ip-masq": true,
  "experimental": false,
  "metrics-addr": "127.0.0.1:9323",
  "max-concurrent-downloads": 3,
  "max-concurrent-uploads": 5,
  "default-runtime": "runc",
  "runtimes": {
    "runsc": {
      "path": "/usr/local/bin/runsc",
      "runtimeArgs": ["--platform=ptrace"]
    }
  }
}

Setting-by-Setting Explanation

Disable Inter-Container Communication (ICC)

{
  "icc": false
}

Prevents containers on the default bridge network from communicating. Each container must use explicit --link or user-defined networks with published ports.

Enable User Namespace Remapping

{
  "userns-remap": "default"
}

Maps container root (UID 0) to a high unprivileged UID on the host. This prevents a container breakout from gaining root on the host.

# Verify userns-remap is active
cat /etc/subuid
# Output: dockremap:100000:65536

cat /etc/subgid
# Output: dockremap:100000:65536

# Verify container UID mapping
docker run --rm alpine id
# uid=0(root) gid=0(root) -- but host UID is 100000+

Disable New Privilege Escalation

{
  "no-new-privileges": true
}

Prevents container processes from gaining additional privileges via setuid/setgid binaries or capability escalation.

Enable Live Restore

{
  "live-restore": true
}

Keeps containers running during daemon downtime, enabling daemon upgrades without container restart.

Disable Userland Proxy

{
  "userland-proxy": false
}

Uses iptables rules instead of docker-proxy for port forwarding, reducing attack surface and improving performance.

TLS Configuration for Remote Docker API

Generate CA and Server Certificates

# Create CA
openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem \
  -subj "/CN=Docker CA"

# Create server key and CSR
openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=docker-host" -sha256 -new -key server-key.pem -out server.csr

# Create extfile with SANs
echo "subjectAltName = DNS:docker-host,IP:10.0.0.5,IP:127.0.0.1" > extfile.cnf
echo "extendedKeyUsage = serverAuth" >> extfile.cnf

# Sign server certificate
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem \
  -CAcreateserial -out server-cert.pem -extfile extfile.cnf

# Create client key and certificate
openssl genrsa -out key.pem 4096
openssl req -subj "/CN=client" -new -key key.pem -out client.csr
echo "extendedKeyUsage = clientAuth" > extfile-client.cnf
openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
  -CAcreateserial -out cert.pem -extfile extfile-client.cnf

# Set permissions
chmod 0400 ca-key.pem key.pem server-key.pem
chmod 0444 ca.pem server-cert.pem cert.pem

# Move to Docker TLS directory
sudo mkdir -p /etc/docker/tls
sudo cp ca.pem server-cert.pem server-key.pem /etc/docker/tls/

Configure daemon.json for TLS

{
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"]
}

Client Connection

docker --tlsverify \
  --tlscacert=ca.pem \
  --tlscert=cert.pem \
  --tlskey=key.pem \
  -H=tcp://docker-host:2376 version

Docker Socket Protection

# Restrict socket ownership
sudo chown root:docker /var/run/docker.sock
sudo chmod 660 /var/run/docker.sock

# Audit Docker socket access
sudo auditctl -w /var/run/docker.sock -k docker-socket

# Never mount Docker socket into containers
# BAD: docker run -v /var/run/docker.sock:/var/run/docker.sock ...

Rootless Docker

# Install rootless Docker
curl -fsSL https://get.docker.com/rootless | sh

# Configure environment
export PATH=$HOME/bin:$PATH
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

# Start rootless daemon
systemctl --user start docker
systemctl --user enable docker

# Verify rootless mode
docker info | grep -i rootless
# Rootless: true

Content Trust (Image Signing)

# Enable Docker Content Trust
export DOCKER_CONTENT_TRUST=1

# Pull only signed images
docker pull library/alpine:3.18
# Will fail if image is not signed

# Sign and push image
docker trust sign myregistry/myapp:1.0

Seccomp Profile

# View default seccomp profile
docker info --format '{{.SecurityOptions}}'

# Use custom seccomp profile
docker run --security-opt seccomp=/etc/docker/seccomp/custom.json alpine

# Verify seccomp is enabled
docker inspect --format='{{.HostConfig.SecurityOpt}}' container_name

AppArmor Profile

# Check AppArmor status
sudo aa-status

# Use custom AppArmor profile
docker run --security-opt apparmor=docker-custom alpine

# Load custom profile
sudo apparmor_parser -r /etc/apparmor.d/docker-custom

Verification Commands

# Check daemon configuration
docker info

# Verify userns-remap
docker info --format '{{.SecurityOptions}}'

# Check ICC setting
docker network inspect bridge --format '{{.Options}}'

# Audit with Docker Bench
docker run --rm --net host --pid host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc:/etc:ro \
  docker/docker-bench-security

Best Practices

1. Never expose Docker daemon without TLS - Always use --tlsverify for remote access
2. Enable user namespace remapping - Map container root to unprivileged host UID
3. Disable ICC - Prevent default bridge network container-to-container communication
4. Use rootless mode - Run Docker daemon as non-root where possible
5. Enable content trust - Only pull signed images
6. Configure log rotation - Prevent log files from filling disk
7. Use seccomp profiles - Restrict syscalls available to containers
8. Audit Docker socket - Monitor access to /var/run/docker.sock
9. Run Docker Bench regularly - Automate CIS benchmark checks
10. Keep Docker updated - Apply security patches promptly

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Docker Daemon Hardening Checklist

Pre-Hardening

• Document current daemon.json configuration
• Run Docker Bench Security baseline
• Identify running containers that may be affected
• Schedule maintenance window
• Backup existing /etc/docker/daemon.json

CIS Docker Benchmark v1.6 - Daemon Checks

Critical

• 2.2 - Disable inter-container communication ("icc": false)
• 2.9 - Enable user namespace remapping ("userns-remap": "default")
• 2.14 - Restrict new privileges ("no-new-privileges": true)
• 2.7 - Configure TLS authentication (if remote access needed)

High

• 2.6 - Use overlay2 storage driver
• 2.16 - Disable userland proxy
• 2.13 - Configure centralized logging
• 2.8 - Set default ulimits
• 2.17 - Apply custom seccomp profile

Medium

• 2.15 - Enable live restore
• 2.1 - Consider rootless mode
• Docker socket permissions set to 660

Post-Hardening Verification

• Docker daemon restarts successfully
• All containers start correctly
• Docker Bench shows improved score
• TLS connection works (if configured)
• Monitoring endpoints accessible
• Log rotation working

Recommended daemon.json

{
  "icc": false,
  "userns-remap": "default",
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "5" },
  "storage-driver": "overlay2",
  "live-restore": true,
  "userland-proxy": false,
  "experimental": false
}

Rollback Plan

1. Stop Docker daemon: sudo systemctl stop docker
2. Restore backup: sudo cp /etc/docker/daemon.json.bak /etc/docker/daemon.json
3. Start Docker daemon: sudo systemctl start docker
4. Verify containers: docker ps

references/api-reference.md (verbatim)

API Reference: Docker Daemon Configuration Hardening

daemon.json Location

• Linux: /etc/docker/daemon.json
• Windows: C:\ProgramData\docker\config\daemon.json

Recommended daemon.json

{
  "icc": false,
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "userns-remap": "default",
  "log-driver": "json-file",
  "log-opts": {"max-size": "10m", "max-file": "3"},
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server-cert.pem",
  "tlskey": "/etc/docker/server-key.pem"
}

CIS Docker Benchmark — Daemon Settings

CIS #	Setting	Recommendation
2.1	icc	Set to false
2.2	live-restore	Set to true
2.3	userland-proxy	Set to false
2.4	no-new-privileges	Set to true
2.6	TLS	Enable with certificates
2.8	userns-remap	Set to default
2.12	Logging	Configure centralized logging

File Permission Checks

File	Permissions
/etc/docker/daemon.json	644
/var/run/docker.sock	660
/etc/docker/certs.d/	444
Docker service files	644

Docker Socket Security

Check permissions

ls -la /var/run/docker.sock
# srw-rw---- 1 root docker 0 ... /var/run/docker.sock

Restrict group access

chmod 660 /var/run/docker.sock
chown root:docker /var/run/docker.sock

Content Trust (Image Signing)

Enable globally

export DOCKER_CONTENT_TRUST=1

In daemon.json

{"content-trust": {"mode": "enforced"}}

Docker Info Command

docker info --format '{{json .}}'

Key Fields

Field	Description
SecurityOptions	seccomp, apparmor, userns
LiveRestoreEnabled	Live restore status
RegistryConfig.InsecureRegistryCIDRs	Insecure registries
ServerVersion	Docker version

references/standards.md (verbatim)

Standards and References - Docker Daemon Hardening

CIS Docker Benchmark v1.6

Section 2: Docker Daemon Configuration

Rule	Description	Status
2.1	Run the Docker daemon as a non-root user	Rootless mode
2.2	Ensure network traffic is restricted between containers	icc: false
2.3	Ensure the logging level is set to info	log-level: info
2.4	Ensure Docker is allowed to make changes to iptables	iptables: true
2.5	Ensure insecure registries are not used	No --insecure-registry
2.6	Ensure aufs storage driver is not used	overlay2 driver
2.7	Ensure TLS authentication for Docker daemon is configured	tlsverify: true
2.8	Ensure the default ulimit is configured appropriately	default-ulimits set
2.9	Enable user namespace support	userns-remap: default
2.10	Ensure the default cgroup usage has been confirmed	cgroup-parent
2.11	Ensure base device size is not changed until needed	Default 10G
2.12	Ensure that authorization for Docker client commands is enabled	AuthZ plugin
2.13	Ensure centralized and remote logging is configured	log-driver
2.14	Ensure containers are restricted from acquiring new privileges	no-new-privileges
2.15	Ensure live restore is enabled	live-restore: true
2.16	Ensure Userland Proxy is disabled	userland-proxy: false
2.17	Ensure daemon-wide custom seccomp profile is applied	seccomp-profile

NIST SP 800-190

• Section 4.1.4: Configuration defects in container images
• Section 5.1: Image security - Content trust enforcement
• Section 5.3: Daemon hardening recommendations

OWASP Docker Security Cheat Sheet

• Rule 0: Keep host and Docker up to date
• Rule 1: Do not expose the Docker daemon socket
• Rule 2: Set a user
• Rule 3: Limit capabilities
• Rule 4: Add no-new-privileges flag
• Rule 5: Disable inter-container communication
• Rule 6: Use Linux Security Module
• Rule 7: Limit resources
• Rule 8: Set filesystem and volumes to read-only
• Rule 9: Use static analysis tools
• Rule 10: Set log level to info

Compliance Mappings

PCI DSS v4.0

• Req 2.2: Develop configuration standards for all system components
• Req 2.2.1: System hardening procedures

SOC 2

• CC6.1: Logical and physical access controls
• CC8.1: Change management

FedRAMP

• CM-6: Configuration Settings
• CM-7: Least Functionality

references/workflows.md (verbatim)

Workflow - Hardening Docker Daemon Configuration

Phase 1: Baseline Assessment

# Check current Docker daemon configuration
docker info
docker system info --format '{{json .SecurityOptions}}'

# Check existing daemon.json
cat /etc/docker/daemon.json 2>/dev/null || echo "No daemon.json found"

# Run Docker Bench Security for baseline
docker run --rm --net host --pid host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc:/etc:ro \
  docker/docker-bench-security 2>&1 | tee docker-bench-baseline.txt

Phase 2: Apply Hardened Configuration

Step 1 - Backup Current Config

sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.bak 2>/dev/null

Step 2 - Deploy Hardened daemon.json

sudo tee /etc/docker/daemon.json <<'EOF'
{
  "icc": false,
  "userns-remap": "default",
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  },
  "storage-driver": "overlay2",
  "live-restore": true,
  "userland-proxy": false,
  "default-ulimits": {
    "nofile": { "Name": "nofile", "Hard": 65536, "Soft": 32768 },
    "nproc": { "Name": "nproc", "Hard": 4096, "Soft": 2048 }
  },
  "experimental": false,
  "metrics-addr": "127.0.0.1:9323"
}
EOF

Step 3 - Restart Docker Daemon

sudo systemctl restart docker
sudo systemctl status docker

Step 4 - Verify Settings

docker info | grep -E "(Remap|ICC|Live Restore|Security)"

Phase 3: TLS Configuration

# Generate certificates (see SKILL.md for full commands)
# Deploy to /etc/docker/tls/

# Add TLS to daemon.json
sudo jq '. + {
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"]
}' /etc/docker/daemon.json | sudo tee /etc/docker/daemon.json.new
sudo mv /etc/docker/daemon.json.new /etc/docker/daemon.json

sudo systemctl restart docker

Phase 4: Post-Hardening Validation

# Run Docker Bench again
docker run --rm --net host --pid host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc:/etc:ro \
  docker/docker-bench-security 2>&1 | tee docker-bench-hardened.txt

# Compare results
diff docker-bench-baseline.txt docker-bench-hardened.txt

Phase 5: Ongoing Monitoring

# Setup auditd rules for Docker
sudo auditctl -w /var/run/docker.sock -k docker
sudo auditctl -w /etc/docker -p wa -k docker-config
sudo auditctl -w /usr/bin/docker -k docker-binary
sudo auditctl -w /var/lib/docker -k docker-data

# Monitor Docker metrics
curl -s http://127.0.0.1:9323/metrics | head -20

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.