Home / Knowledge hub / Docker
Knowledge hub
Docker
A tool for packaging an app and its dependencies into a portable container.
What it means
Docker is a tool for building and running containers. A container bundles your application with the libraries and settings it needs, so it behaves the same on a laptop, a test server and production. The package it is built from is called an image.
Containers are not small virtual machines. They share the host's operating system kernel and are separated from each other by features of that kernel. That makes them light and fast, and it also means the walls are thinner than a full virtual machine's.
Why it matters
Images carry whatever you put in them, including old packages with known flaws and, by accident, secrets. Because the same image is copied to many places, one weak image is repeated everywhere it runs.
Containers also change who is responsible. A developer can now decide the operating system layer, which used to belong to operations. Settings such as running as root or mounting the Docker socket can hand a small bug in the app a path to the host and its neighbours.
How it shows up
You meet Docker in Dockerfiles, CI pipelines, registries and orchestrators. Build an image, push it to a registry, and run it. Each step is a place to check: what the base image is, what was copied in, and which user the process runs as.
The mistakes repeat. Containers run as root. Secrets are baked into layers and stay in history. The latest tag is trusted blindly. The Docker socket is mounted into a container, which gives it control of the host. Scan images, run as a normal user, and keep the secrets out of the image.
Questions people ask
Docker, answered
Is a container the same as a virtual machine?
No. A virtual machine includes its own operating system kernel. A container shares the host's kernel, so isolation is lighter and a kernel flaw can affect all containers on that host.
Are containers secure by default?
They give useful isolation, but the defaults are not a complete security setup. You still need to limit privileges, patch images, restrict networks and protect the Docker daemon.
Why is running as root in a container a problem?
If an attacker takes over the process, they hold root inside the container, which makes a breakout easier. A normal user account narrows what they can do.
What does mounting the Docker socket do?
It lets the container send commands to the Docker daemon on the host, which is close to full control of that host. Avoid it unless there is no other way.
Do we need to scan images?
Yes. Images contain packages that age and gain published flaws. Scan at build time and again on a schedule, since new flaws are published after you ship.
Sources
Where this comes from
Related
Terms that sit next to this one
Container image scanning
Checking a built image for known-vulnerable packages before it ships.
Base image
The starting image your container builds on, and the old packages it can bring.
Privileged container
A container given near-host powers, so a flaw inside it is a flaw in the host.
Container escape
Breaking out of a container to reach the machine that hosts it.
Rootless container
A container run as an ordinary user, limiting damage if it is broken into.
What is inside your image?
We test the running application for flaws that a container does not hide, and we report only what we exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.