skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hardening-docker-daemon-configuration

Configures and validates Docker daemon security settings against CIS benchmarks.

Updated Jan 29, 2024
Search Tags:#docker#tls#security-audit#cis-benchmark#daemon-hardening#userns-remap#docker-bench-security
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill hardening-docker-daemon-configuration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hardening-docker-daemon-configuration
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/hardening-docker-daemon-configuration
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill hardening-docker-daemon-configuration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires json, os, subprocess, argparse, pathlib, datetime, timezone, stat, auditctl, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you reduce the attack surface of the Docker daemon by hardening daemon.json and related security controls, preventing common privilege-escalation and container-breakout risks.

Core Features & Use Cases

  • CIS-aligned daemon.json hardening: Applies key settings such as userns-remap, no-new-privileges, logging controls, and inter-container communication restrictions.
  • Remote API protection with TLS: Generates CA/server/client certificates and configures tls, tlsverify, and certificate paths to secure TCP access.
  • Security validation and auditing: Uses included Python audit scripts to check daemon configuration and Docker socket/file permissions against benchmark expectations.
  • Operational hardening options: Covers rootless mode, seccomp/AppArmor guidance, content trust, and Docker Bench verification for ongoing compliance.

Quick Start

Use the hardening-docker-daemon-configuration Skill to audit your current Docker daemon configuration against CIS recommendations and output a remediation-ready hardening report.

Frequently Asked Questions about hardening-docker-daemon-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden Docker daemon configuration against CIS Benchmark recommendations?▼

To harden Docker daemon configuration against CIS Benchmark recommendations, you apply security settings in daemon.json such as userns-remap, no-new-privileges, and logging controls. This Skill validates your setup and outputs a remediation-ready hardening report for compliance workflows.

What is user namespace remapping for Docker container isolation?▼

User namespace remapping for Docker container isolation prevents privilege-escalation by mapping container root to an unprivileged host user. This Skill configures the userns-remap daemon.json setting to reduce container-breakout risks on Linux Docker hosts.

How do I secure Docker remote API access with TLS?▼

Securing Docker remote API access with TLS involves generating CA, server, and client certificates, then configuring tls, tlsverify, and certificate paths. This Skill automates TLS enforcement to protect TCP access for admin workflows.

Does Docker daemon hardening work with rootless mode and seccomp profiles?▼

Docker daemon hardening works with rootless mode, seccomp, and AppArmor guidance to provide layered container isolation. This Skill includes operational hardening options alongside daemon.json configurations for Linux Docker hosts requiring safer deployments.

What is the best way to audit Docker socket and file permissions for security compliance?▼

The best way to audit Docker socket and file permissions for security compliance is using Python audit scripts to check configurations against benchmark expectations. This Skill validates permissions and uses Docker Bench verification for ongoing compliance.

Why restrict inter-container communication in Docker daemon settings?▼

Restricting inter-container communication in Docker daemon settings limits the network attack surface by preventing unauthorized container traffic. This Skill hardens daemon.json with ICC restrictions to ensure safer container isolation on Linux Docker hosts.

Related Skills

Explore More Legal & Compliance Skills→
balsm-healthbalsm-health
2

hardening-docker-daemon-configuration

Automate Docker daemon hardening against CIS Docker Benchmark security settings.

Official
Advanced
balsm-healthbalsm-health
2

hardening-docker-containers-for-production

Automate Docker container hardening with CIS Docker Benchmark v1.8.0.

Official
Advanced
martinholovskymartinholovsky
45

sandboxing

Sandbox untrusted code execution with syscall filtering and resource limits.

Community
Advanced
riandeoliveirariandeoliveira

hardening-docker-containers-for-production

Harden Docker daemon, images, and runtime configurations using CIS Docker Benchmark v1.8.0.

Community
Advanced