hardening-docker-daemon-configuration

# Hardening Docker Daemon Configuration ## Overview The Docker daemon (`dockerd`) runs with root privileges and controls all container operations. Hardening its configuration through `/etc/docker/daemon.json`, TLS certificates, user namespace remapping, and network restrictions is essential to prevent privilege escalation, lateral movement, and container breakout attacks. ## When to Use - When deploying or configuring hardening docker daemon configuration capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Docker Engine 24.0+ installed - Root or sudo access to the Docker host - OpenSSL for TLS certificate generation - Understanding of Linux namespaces and cgroups ## Core Hardened daemon.json ```json { "icc": false, "userns-remap": "default", "no-new-privileges": true, "log-driver": "json-file", "log-opts": { "max-size": "10m", "max-file": "5" }, "storage-driver": "overlay2", "live-restore": true, "userland-proxy": false, "default-ulimits": { "nofile": { "Name": "nofile", "Hard": 65536, "Soft": 32768 }, "nproc": { "Name": "nproc", "Hard": 4096, "Soft": 2048 } }, "seccomp-profile": "/etc/docker/seccomp/default.json", "default-address-pools": [ { "base": "172.17.0.0/1...