Service Overview

The Container Docker & LXC service supports organizations in the design, secure implementation and operational management of containerized infrastructure based on Docker, Docker Compose, LXC/LXD and, for more complex environments, Kubernetes. Containerization offers significant advantages in terms of portability, insulation and deployment speed—but introduces a specific attack surface that requires dedicated security skills, often absent in traditional development teams and operations.

The NIST and the main cloud security frameworks identify container security as a critical area: known vulnerability images, unsafe runtime configurations, running containers with excessive privileges and networked Daemon Docker are among the most frequent causes of compromise in cloud-native environments.

Activities

The service includes: security review of Docker images (vulnerability scanning with Trivy, Grype, Docker Scout; only verification of the use of minimal and up-to-date basic images; identification of secrets and embedded credentials in the layers); hardening of the configuration of the Docker daemon (TLS authentication, user namespace remapping, drymp profiles, AppArmor profiles); implementation of runtime security policies

For LXC/LXD, we configure security profiles, capabilities limitation, user namespace isolation and storage volume management with encryption at rest where required by the risk profile.

Deliverable

Assessment of current configuration with gap analysis, hardening playbook implemented and documented, automatic scanning of images in the release pipelines, and operational training to DevOps team on container security principles.