Answers: <p>Check out the <a href="https://docs.docker.com/engine/reference/commandline/dockerd/" rel="nofollow noreferrer">dockerd options</a>.  This will apply to all containers managed by the Docker Daemon.</p>
  
  <p>Docker also has quite a bit of documentation on how to enforce different standards and compliance <a href="https://docs.docker.com/compliance/" rel="nofollow noreferrer">here</a>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-09-18T18:29:31.737Z
Answers: 2019-09-18T18:29:31.737Z
Answers: Wesley Rolnick
Body: <p>I am going through compliance tasks to harden our Docker setup and I am seeing many things like</p>
  
  <ul>
  <li>Favor using <code>docker run</code> with <code>docker run --pids-limit 100</code> to prevent forkbombs</li>
  <li>Favor using <code>docker run</code> with <code>docker run --security-opt=no-new-privileges</code> to be safe</li>
  </ul>
  
  <p>etc...</p>
  
  <p>I want to know if I can apply these settings across the board by, say, putting</p>
  
  <pre><code>...
  "pids-limit": "100",
  "security-opt": "no-new-privileges",
  ...
  </code></pre>
  
  <p>in <code>/etc/docker/daemon.json</code></p>
  
  <p>I prefer to just have a hardened config on all my machines I am hardening.</p>
  
  <p>Tips and tricks?</p>
  
  <p>Thanks.</p>
  
Tags: <docker><security><devsecops>
Title: Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?
UserDisplayName: David West
ThreadText: # Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?
  
  (Asked by: username_0 on 2019-09-17)
  
  I am going through compliance tasks to harden our Docker setup and I am seeing many things like
  
  * Favor using `docker run` with `docker run --pids-limit 100` to prevent forkbombs
  * Favor using `docker run` with `docker run --security-opt=no-new-privileges` to be safe
  
  etc...
  
  I want to know if I can apply these settings across the board by, say, putting
  
  ```
  ...
  "pids-limit": "100",
  "security-opt": "no-new-privileges",
  ...
  
  ```
  
  in `/etc/docker/daemon.json`
  
  I prefer to just have a hardened config on all my machines I am hardening.
  
  Tips and tricks?
  
  Thanks.
  
  **Tags:** docker, security, devsecops
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-09-18. Score: 1 | Accepted answer
  
  Check out the [dockerd options](https://docs.docker.com/engine/reference/commandline/dockerd/). This will apply to all containers managed by the Docker Daemon.
  
  Docker also has quite a bit of documentation on how to enforce different standards and compliance [here](https://docs.docker.com/compliance/).
  
  
  ---
  
  