How to Monitor & Secure Docker on Linux Server – Easy Guide

To monitor and secure Docker on a Linux server, deploy a metrics stack (cAdvisor + Prometheus + Grafana), centralize container logs, and enable audit events. Then harden Docker using least privilege (drop capabilities, no-privileged), AppArmor/SELinux, seccomp, rootless or user namespaces, read-only filesystems, network controls, image scanning (Trivy), and automated alerts.

Managing containers in production starts with visibility and defense. In this guide, you’ll learn how to monitor and secure Docker on a Linux server with a practical, step-by-step workflow we use on real customer stacks. We’ll combine lightweight monitoring with hardened runtime settings, so you can proactively detect issues and reduce risk without slowing deployments.

Our primary focus is simple: monitor and secure Docker on Linux server environments with proven tools and configurations that align with the CIS Docker Benchmark and modern cloud-native security practices. If you’re running Docker on Ubuntu, Debian, or RHEL-based distributions, this is your blueprint.

What You’ll Set Up (At a Glance)

• Metrics: cAdvisor + Prometheus + Grafana dashboards
• Logs: Docker log rotation + centralized aggregation (Fluent Bit/Loki or syslog)
• Events & Auditing: Docker events, Linux auditd, and optional runtime detection with Falco
• Hardening: user namespaces/rootless, seccomp, AppArmor/SELinux, least privilege, read-only FS
• Supply Chain: image scanning (Trivy), signed images (cosign), SBOMs (syft)
• Policies & Alerts: Alertmanager rules, CI image scanning, periodic Docker Bench checks

Prerequisites

• Linux host: Ubuntu 22.04/24.04, Debian 12, or RHEL 8/9
• Docker Engine 24+ (or Moby) with systemd
• Basic Linux shell skills and sudo access
• Outbound internet to pull images and send alerts/logs

Monitoring Docker: Build a Lightweight, Reliable Stack

1) Collect container and host metrics with cAdvisor + Prometheus

cAdvisor exposes container CPU, memory, filesystem, and network metrics; Prometheus scrapes and stores them; Grafana visualizes and alerts. This combo is industry-standard and low overhead.

# Run cAdvisor to expose metrics on :8080
sudo docker run -d \
  --name=cadvisor \
  --restart=always \
  --volume=/:/rootfs:ro \
  --volume=/var/run:/var/run:ro \
  --volume=/sys:/sys:ro \
  --volume=/var/lib/docker/:/var/lib/docker:ro \
  --publish=8080:8080 \
  gcr.io/cadvisor/cadvisor:latest

# Run Prometheus configured to scrape cAdvisor
cat > prometheus.yml <<'EOF'
global:
  scrape_interval: 15s
scrape_configs:
  - job_name: "cadvisor"
    static_configs:
      - targets: ["localhost:8080"]
EOF

sudo docker run -d \
  --name=prometheus \
  --restart=always \
  -p 9090:9090 \
  -v $(pwd)/prometheus.yml:/etc/prometheus/prometheus.yml:ro \
  prom/prometheus:latest

# Grafana for dashboards
sudo docker run -d \
  --name=grafana \
  --restart=always \
  -p 3000:3000 \
  grafana/grafana:latest

Import community dashboards such as “Docker and system monitoring” in Grafana. Add Alertmanager to fire alerts (CPU throttling, OOM kills, container restarts, disk usage > 80%).

2) Centralize logs with rotation and aggregation

Enable per-container log rotation to prevent disk fill. The “local” log driver is efficient and supports size-based rotation.

# /etc/docker/daemon.json
{
  "log-driver": "local",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  }
}
# Apply changes
sudo systemctl restart docker

For centralized logging, forward to Fluent Bit and stream to Loki/Elasticsearch or to syslog/SIEM. This gives searchable history for incidents and forensics.

3) Track Docker events and Linux audit logs

Docker emits events for container lifecycle and image pulls. Pipe them to your SIEM or alerting system.

# Stream events (optionally pipe to a log collector)
sudo docker events --format '{{json .}}'

Enable auditd to watch Docker binaries and state directories. This surfaces unauthorized changes and suspicious activity on the host.

# /etc/audit/rules.d/docker.rules
-w /usr/bin/dockerd -p x -k docker
-w /usr/bin/docker -p x -k docker
-w /etc/docker/ -p wa -k docker
-w /var/lib/docker/ -p wa -k docker

# Load rules
sudo augenrules --load
sudo systemctl restart auditd

Security Hardening: A Practical Baseline for Docker on Linux

1) Keep the host minimal and updated

• Patch kernel and Docker Engine regularly.
• Use a minimal OS profile; remove unused packages and compilers.
• Limit SSH access, disable root login, and enforce MFA where possible.

2) Harden Docker daemon defaults

Set secure defaults so every container starts with least privilege and good hygiene.

# /etc/docker/daemon.json (hardened defaults)
{
  "icc": false,
  "no-new-privileges": true,
  "userns-remap": "default",
  "live-restore": true,
  "log-driver": "local",
  "log-opts": { "max-size": "10m", "max-file": "5" },
  "default-ulimits": { "nproc": { "Name": "nproc", "Hard": 4096, "Soft": 4096 } },
  "features": { "buildkit": true },
  "iptables": true
}
# Restart Docker
sudo systemctl daemon-reload && sudo systemctl restart docker

Explanation: user namespaces reduce container-to-host privilege, no-new-privileges blocks privilege escalation, live-restore keeps containers running during daemon upgrades, and ICC=false disables inter-container communication on the default bridge.

3) Prefer rootless or remapped (userns) containers

Rootless Docker runs the daemon as a non-root user; user namespaces remap root inside the container to an unprivileged host UID. Both materially reduce impact if a container is compromised.

# Quick check of user namespaces status
grep -E "userns-remap" /etc/docker/daemon.json || echo "Enable userns-remap for stronger isolation"

4) Enforce seccomp and AppArmor/SELinux

Use Docker’s default seccomp profile (blocks dangerous syscalls). Keep AppArmor (Ubuntu/Debian) or SELinux (RHEL) enforcing. Create custom profiles for sensitive workloads.

# Example run flags (non-root, least capability, syscall and LSMS)
docker run -d --name web \
  --read-only \
  --pids-limit 200 \
  --cpus="1.0" --memory="512m" \
  --security-opt no-new-privileges \
  --security-opt seccomp=default \
  --cap-drop ALL --cap-add NET_BIND_SERVICE \
  -u 10001:10001 \
  -v /srv/web/static:/srv/web/static:ro \
  -p 80:8080 myorg/web:1.0.0

5) Use read-only filesystems and tight volume mounts

• Make the root filesystem read-only; mount only necessary writable paths (tmpfs for /tmp).
• Avoid mounting the Docker socket into containers.
• Use explicit, minimal bind mounts and set :ro when possible.

6) Network segmentation and firewall rules

• Disable inter-container communication (ICC=false) and use custom Docker networks per app boundary.
• Restrict inbound ports with iptables/nftables or UFW; egress restrict sensitive workloads.
• Terminate TLS at a hardened reverse proxy (e.g., Nginx, Traefik) with modern ciphers.

7) Secrets management

• Do not store secrets in images or environment variables.
• Provide secrets via read-only files (tmpfs) or external secret stores (Vault, SOPS, cloud KMS).
• Restrict who can see container runtime configs and logs.

8) Supply chain security: scan, sign, and SBOM

Scan images for CVEs, sign them, and attach SBOMs to trace dependencies. Enforce policies to block unscanned/unsigned images.

# Scan images for vulnerabilities (CI-friendly)
trivy image myorg/web:1.0.0

# Generate SBOM
syft myorg/web:1.0.0 -o json > sbom.json

# Sign image (keyless or with key) using cosign
cosign sign myorg/web:1.0.0
cosign verify myorg/web:1.0.0

9) Runtime threat detection (optional but recommended)

Deploy Falco to detect suspicious syscalls and container behaviors (crypto mining, namespace escapes, unexpected shell spawns). Send alerts to Slack, email, or SIEM.

Operationalizing: Policies, Alerts, and Periodic Checks

• Prometheus alerts: container restarts > N, OOM kills, CPU throttling, disk usage > 80%, high 5xx error rate.
• CI/CD gates: block images with critical CVEs; require signature verification.
• Monthly: run Docker Bench for Security; review audit logs and Falco alerts.
• Quarterly: rotate secrets, prune unused images, update base images.

# Run Docker Bench for Security (read-only mounts)
docker run --rm -it --net host --pid host --userns=host \
  --cap-add audit_control \
  -v /etc:/etc:ro \
  -v /usr/bin/docker:/usr/bin/docker:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /usr/lib/systemd:/usr/lib/systemd:ro \
  -v /etc/os-release:/etc/os-release:ro \
  docker/docker-bench-security

Tuning for Performance and Cost

• Set CPU and memory limits to avoid noisy neighbors and to keep dashboards actionable.
• Reduce scrape intervals for noisy targets; disable unnecessary exporters.
• Use the “local” Docker log driver with rotation to minimize disk churn; forward only what you need.
• Consolidate Grafana dashboards and archive metrics/indices on a schedule.

Validation: Quick Security and Monitoring Checks

• Run a test container and verify limits: check cgroup metrics in Grafana after stressing CPU/memory.
• Trigger a benign alert (e.g., restart a container repeatedly) and confirm Alertmanager delivery.
• Verify user namespaces: inside the container, id should not map to host root; inspect /proc/self/uid_map.
• Confirm AppArmor/SELinux enforcing and seccomp active via docker inspect and dmesg/audit logs.

Common Mistakes to Avoid

• Running containers with –privileged by default.
• Exposing the Docker socket to containers or over the network.
• Skipping log rotation and filling disks.
• Using latest tags without version pinning and signing policies.
• Forgetting to limit filesystem writes or leaving wide-open bind mounts.
• Neglecting alert fatigue: create targeted, meaningful alerts instead of dozens of noisy ones.

Practical Examples: Secure Container Run Templates

# Web service with least privilege and resource limits
docker run -d --name api \
  --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --pids-limit 300 --cpus="2" --memory="1g" --memory-swap="1g" \
  --cap-drop ALL --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges \
  -u 10001:10001 \
  -v /srv/api/config:/app/config:ro \
  -p 443:8443 myorg/api:2.3.1

# Worker without network access (on a private network only)
docker network create --internal jobs
docker run -d --name worker \
  --network jobs \
  --read-only --pids-limit 200 \
  --cpus="1" --memory="512m" \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -u 10002:10002 \
  -v /srv/queue:/queue:ro \
  myorg/worker:1.9.0

FAQs: Monitoring and Securing Docker on Linux