## Docker Security Hardening

Docker is not secure by default.

### 1. Rootless Mode
*   **Risk**: By default, the Docker daemon runs as **root**.
*   **Fix**: Configure Docker to run in "Rootless Mode" (User Namespace Remapping).
*   *Why*: If a hacker breaks out of the container, they are "nobody" on the host, not "root".

### 2. Capabilities (Linux Capabilities)
*   Linux decomposes "Root" privileges into small slices (CAP_NET_ADMIN, CAP_SYS_BOOT, etc.).
*   **Hardening**: Drop all capabilities, then add back only what you need.
    *   `docker run --cap-drop=all --cap-add=NET_BIND_SERVICE ...`

### 3. Read-Only Filesystem
*   Containers should be **Immutable**. You shouldn't patch a running container; you deploy a new one.
*   **Flag**: `--read-only`.
*   *Why*: Attackers cannot download malware or modify `/etc/passwd`.

### 4. Do not expose the Docker Socket
*   `/var/run/docker.sock` is the API key to the kingdom. If you mount this into a container, that container has full root control over the host.
*   **Rule**: Never mount the socket unless absolutely necessary (e.g., for a monitoring agent).