What are best and comprehensive practices to consider when running docker in production? Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so. The other organization can't afford it by a policy forbidding production processes running in root mode.

What could be a checklist of building blocks to consider for a Docker production environment? One does not need all of them, but all of them should be important to be assessed.

Disclaimer: I know there is a SE policy to avoid "large endless lists" but I think this checklist cannot be very big... and endless noway.

So - what are these buildings blocks?


If not already deployed, consider running a Linux host system with advanced 
security settings - hardened kernel, SELinux etc.
Consider using a tiny Docker base image, like alpine, busybox or even scratch e.g. start with an empty base image
Use USER setting other than root 
Carefully assess to further reduce the already shrinked set of kernel capabilities granted to container
Consider having only one executable binary per container to launch your process, ideally statically linked
Those who want to break your system to get a shell access might wonder if they found out your container has all shells disabled
Mount read-only volumes where only possible


Question: what else?
The host on which the containers are running

Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security

Running the following command on a node that runs docker containers:

docker run -it --net host --pid host --cap-add audit_control \
    -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
    -v /var/lib:/var/lib \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v /usr/lib/systemd:/usr/lib/systemd \
    -v /etc:/etc --label docker_bench_security \
    docker/docker-bench-security


returns a list of checks:

[INFO] 1 - Host Configuration

[WARN] 1.1  - Ensure a separate partition for containers has been created

[NOTE] 4.2  - Ensure that containers use trusted base images

[PASS] 4.6  - Ensure HEALTHCHECK instructions have been added to the container image


Quote from the repository README:


  The Docker Bench for Security is a script that checks for dozens of
  common best-practices around deploying Docker containers in
  production. The tests are all automated, and are inspired by the CIS
  Docker Community Edition Benchmark
  v1.1.0.


Some of the issues that are reported by the security bench could be solved by reading the official docker security article and comparing it with the bullets that are defined in the question the following things are important as well:


protect the docker daemon socket by implementing ssl
content trust using notary and DOCKER_CONTENT_TRUST variable