REVIEW OF MODERN APPROACHES TO SECURE DOCKER COMPOSE CONFIGURATION

DOI: 10.31673/2409-7292.2025.041213

Abstract

The article provides an analytical review of modern approaches to ensuring the security of container configurations, in
particular in the context of using Docker Compose as a tool for declarative description of multi-container systems. Key problems
associated with configuration errors in docker-compose.yml files, which can lead to violations of the confidentiality, integrity
and availability of containerized services, are identified. The capabilities and limitations of existing security verification tools
are analyzed: Docker Bench for Security, OpenSCAP, Trivy, Checkov, KICS and others, in terms of their effectiveness in
analyzing the configuration level. Particular attention is paid to the issues of compliance of configurations with international
standards and security recommendations, in particular CIS Docker Benchmark and DevSecOps practices. As a result of the
study, the main types of risks characteristic of Docker Compose environments are identified, and a conceptual classification of
such risks is proposed according to the categories of confidentiality, integrity, availability, isolation and compliance with
standards. The need for creating unified policies for secure Docker Compose configuration and developing automated
verification tools integrated into CI/CD processes is substantiated. The results form a theoretical basis for further research in the
field of ensuring the security of container configurations and developing practical tools for their auditing.
Keywords: containerization, Docker Compose, configuration security, DevSecOps, Docker Bench for Security,
OpenSCAP, container environments.

References
1. Center for Internet Security. CIS Docker Benchmark v1.6.0 [Електронний ресурс] // CIS. 2023. Режим
доступу: https://www.cisecurity.org/benchmark/docker.
2. Docker. Docker Bench for Security [Електронний ресурс] // GitHub Repository. 2024. Режим доступу:
https://github.com/docker/docker-bench-security.
3. Aqua Security. Trivy: A Simple and Comprehensive Vulnerability Scanner for Containers and IaC
[Електронний ресурс] // Aqua Security. 2024. Режим доступу: https://aquasec.com/tools/trivy.
4. Bridgecrew. Checkov: Infrastructure as Code static analysis tool [Електронний ресурс] // Bridgecrew. 2024.
Режим доступу: https://www.checkov.io/.
5. Checkmarx. KICS – Keeping Infrastructure as Code Secure [Електронний ресурс] // Checkmarx Docs. 2024.
Режим доступу: https://docs.kics.io/latest/queries/dockercompose-queries.
6. GoodwithTech. Dockle – Container Image Linter for Security [Електронний ресурс] // GitHub Repository.
2023. Режим доступу: https://github.com/goodwithtech/dockle.
7. OWASP Foundation. Container Security Verification Standard (CSVS), Draft v0.9 [Електронний ресурс] //
OWASP. 2023. Режим доступу: https://owasp.org/.
8. Docker. Managing Secrets in Docker Compose [Електронний ресурс] // Official Documentation. 2024. Режим
доступу: https://docs.docker.com/compose/use-secrets/.
9. OWASP Foundation. Docker Security Cheat Sheet [Електронний ресурс] // OWASP Cheat Sheet Series. 2023.
Режим доступу: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html.
10. Docker Documentation. Networking in Compose [Електронний ресурс] // Docker Docs. 2024. Режим
доступу: https://docs.docker.com/compose/networking/.
11. Docker Documentation. Compose Deploy Resources [Електронний ресурс] // Docker Docs. 2024. Режим
доступу: https://docs.docker.com/compose/compose-file/deploy/#resources.
12. Snyk Ltd. Container Security: Volume Mount Risks [Електронний ресурс] // Snyk Learn. 2023. Режим
доступу: https://snyk.io/learn/docker-security/.
13. Red Hat. Running Containers as Non-root [Електронний ресурс] // Red Hat Container Security. 2022. Режим
доступу: https://www.redhat.com/en/topics/containers.
14. National Institute of Standards and Technology (NIST). Application Container Security Guide (SP 800-190)
[Електронний ресурс] // NIST Publications. 2017. Режим доступу: https: // nvlpubs. nist. gov / nistpubs /
SpecialPublications/NIST.SP.800-190.pdf.
15. Open Policy Agent. Rego Policy Language Documentation [Електронний ресурс] // OPA Docs. 2024. Режим
доступу: https://www.openpolicyagent.org/docs/latest/.
16. GitLab Documentation. Shift Left Security in CI/CD Pipelines [Електронний ресурс] // GitLab Docs. 2023.
Режим доступу: https://docs.gitlab.com/ee/topics/security/shift_left_security.html.
17. Docker Documentation. Compose File Reference (v3.9) [Електронний ресурс] // Docker Docs. 2024. Режим
доступу: https://docs.docker.com/compose/compose-file/.
18. Google Cloud Security. Machine Learning for Misconfiguration Detection [Електронний ресурс] // Google
Cloud Security Blog. 2023. Режим доступу: https://cloud.google.com/security.