**The host on which the containers are running** Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security Running the following command on a node that runs docker containers: docker run -it --net host --pid host --cap-add audit_control \ -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \ -v /var/lib:/var/lib \ -v /var/run/docker.sock:/var/run/docker.sock \ -v /usr/lib/systemd:/usr/lib/systemd \ -v /etc:/etc --label docker_bench_security \ docker/docker-bench-security returns a list of checks: [INFO] 1 - Host Configuration [WARN] 1.1 - Ensure a separate partition for containers has been created [NOTE] 4.2 - Ensure that containers use trusted base images [PASS] 4.6 - Ensure HEALTHCHECK instructions have been added to the container image Quote from the repository README: > The Docker Bench for Security is a script that checks for dozens of > common best-practices around deploying Docker containers in > production. The tests are all automated, and are inspired by the [CIS > Docker Community Edition Benchmark > v1.1.0](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_Community_Edition_Benchmark_v1.1.0.pdf). Some of the issues that are reported by the security bench could be solved by reading [the official docker security article][1] and comparing it with the bullets that are defined in the question the following things are important as well: * protect the docker daemon socket by implementing ssl * content trust using notary and `DOCKER_CONTENT_TRUST` variable [1]: https://docs.docker.com/engine/security/security/