The Docker security philosophy is “secure by default”
&quot;Secure by default&quot; is a great philosophy to have. I hope Docker continues to push into this direction.<p>However, where is image signing? Where is pulling images by their hash instead of mutable tags? Where is restricting what images run according to their hashes? Where is Docker not running a daemon as root? How about Docker doing more hardening releases and fewer feature releases?<p>There&#x27;s a lot of low hanging, security related fruit which haven&#x27;t been picked. Why not?<p>Process isolation is a fantastic. There just really needs to be more, in my opinion.