Docker – Mount Volumes from Device Instead of Directory

Securing a docker engine requires paying attention to many different aspects, and defense in depth is always about layers of security.

One of the requirements you have listed, restricting what users can command the docker engine to do, is probably one of the most important, as, as of now, the docker engine does not implement an authorisation control.

Your alternatives include:

• closed-source solutions like Twistlock, a project that implements RBAC and policy control to access the docker API

• OpenShift Origin, an open source project that implements role-based access control in the form of security constraints and fine-grained authorisation policies. It's fairly easy to deploy and would greatly help to have an out-of-the-box solution.

I would also suggest to look into the different operating systems a docker engine can be deployed to, and would advise not to use a general purpose OS but a specialised one, such as Atomic. Both, Atomic and OpenShift together, will ensure that you also can:

• Scan your images regularly.
• Use a trusted registry
• Define seccomp profiles for your containers. Improvements to this technology and its implementation is a work in progress in the docker world as a whole.
• Drop capabilities that are not needed by the application in the container.
• Use SELinux. Many of the other security measures listed have limitations, but SELinux works very well in providing a safe net when everything else fails. Some examples: it will help limiting access to the docker socket, it will control whether sharing file descriptors between containers is allowed, it can assign different MCS levels to each container/group of containers to isolate them from the host and from other containers.

When you create a volume via Docker or Portainer, by default this volume will be stored in /var/lib/docker/volumes on the host. So that is the defaut and correct behavior.

If you want to bind a volume called db via Portainer, create a volume first. Then go into Containers > Add container > Specify your name/image here > In the volume tab you'll be able to bind the volume you just created to a path in the container.

Now, about your link between Ningx and your database. I recommend that you leverage the DNS of Docker networks here.

First, create a new network (call it my-app for example). Then, deploy both your database and Nginx container inside this network. Docker DNS will automatically give the ability to containers inside the same network to communicate using their container name. So if you've named your database container db and your Nginx container nginx, then you'll be able to ping db from nginx and vice-versa.