Containers Still Depend on a Secure Host

Environment and inputs: A disposable container deployment, its manifest, effective runtime settings and a repeatable application health check.

A container is not an automatic security boundary for every threat. Containers share the host kernel, and access to the Docker daemon socket can effectively grant control of the host. OWASP recommends maintaining both the host and runtime and limiting privileges inside containers.

What matters

• Run application processes as an appropriate non-root user where possible.
• Avoid privileged containers and unnecessary access to the Docker socket.
• Keep images, runtime packages, and the host patched, with resource limits for workloads.

Practical example: A small web service runs with a read-only application image and only the specific writable storage it needs.

One action today: Inspect one deployment for root execution, privileged mode, and Docker socket mounts.