**The host on which the containers are running**

Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security

Running the following command on a node that runs docker containers:

    docker run -it --net host --pid host --cap-add audit_control \
        -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
        -v /var/lib:/var/lib \
        -v /var/run/docker.sock:/var/run/docker.sock \
        -v /usr/lib/systemd:/usr/lib/systemd \
        -v /etc:/etc --label docker_bench_security \
        docker/docker-bench-security

returns a list of checks:

    [INFO] 1 - Host Configuration
    
    [WARN] 1.1  - Ensure a separate partition for containers has been created
    
    [NOTE] 4.2  - Ensure that containers use trusted base images
    
    [PASS] 4.6  - Ensure HEALTHCHECK instructions have been added to the container image

Quote from the repository README:

> The Docker Bench for Security is a script that checks for dozens of
> common best-practices around deploying Docker containers in
> production. The tests are all automated, and are inspired by the [CIS
> Docker Community Edition Benchmark
> v1.1.0](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_Community_Edition_Benchmark_v1.1.0.pdf).

Some of the issues that are reported by the security bench could be solved by reading [the official docker security article][1] and comparing it with the bullets that are defined in the question the following things are important as well:

 * protect the docker daemon socket by implementing ssl
 * content trust using notary and `DOCKER_CONTENT_TRUST` variable


  [1]: https://docs.docker.com/engine/security/security/