Source: Originally based on a comparison published by sysdig.com.
Docker is not inherently insecure. Features such as process isolation via user namespaces, resource encapsulation with cgroups, immutable images, and minimal dependency shipping all reduce the attack surface significantly. That said, there is much more you can do beyond basic image vulnerability scanning. This guide covers 20 container and Docker-specific security tools, organized by use case, to help you implement defence-in-depth for your containerized workloads.
1. Anchore Navigator
Homepage: https://anchore.io/
License: Commercial; some services are free to use.
Use Cases: Pre-production image analysis, CVE newsfeed.
Anchore Navigator provides deep inspection of public Docker images, including full visibility into image contents, build history, and discovered CVE threats — each linked to a complete issue description and known fixes. You can analyze your own private images and subscribe to images you frequently deploy, receiving security alerts when new vulnerabilities are disclosed. Upgrading to the commercial tier unlocks additional scanning depth and subscription features.
2. AppArmor
Homepage: http://wiki.apparmor.net
License: Open Source.
Use Cases: Runtime protection, Mandatory Access Control (MAC).
AppArmor is a Linux Mandatory Access Control (MAC) system that lets administrators assign per-program security profiles governing filesystem access, network capabilities, link and execute rules, and more. When a forbidden action is attempted, AppArmor blocks it and can log the violation for review.
AppArmor is often considered a more accessible alternative to SELinux — you only need to learn the profile language syntax to start writing your own rules. Docker automatically generates and loads a default AppArmor profile for containers named docker-default, and you can create specific security profiles for individual containers or the applications running inside them.
3. Aqua Security
Homepage: https://www.aquasec.com/
License: Commercial.
Use Cases: Pre-production analysis, runtime protection, compliance and audit.
Aqua Security is a commercial container security platform designed from the ground up for containerized environments. Key capabilities include security auditing, container image verification, runtime protection, automated policy learning, and intrusion prevention. The platform supports orchestration tools including Docker Swarm, Mesos, Kubernetes, and OpenShift, and can be deployed on-premises or in public cloud environments. A programmatic API is available for CI/CD pipeline integration.
4. Black Duck Docker Security
Homepage: https://www.blackducksoftware.com
License: Commercial.
Use Cases: Pre-production analysis, vulnerability newsfeed, license and legal risk assessment.
Black Duck Hub specializes in container inventory and reporting, mapping known CVEs to indexed image contents and generating cross-project risk reports. The tool can pinpoint specific libraries, software packages, or binaries that introduce security risk and automatically suggest known fixes.
A differentiating feature is Black Duck’s “License Risk” analysis, which evaluates the open-source license obligations introduced by every component bundled into your container images — an important but often overlooked compliance concern.
5. Cilium
Homepage: https://www.cilium.io/
License: Open Source.
Use Cases: HTTP-layer network security, network-layer security policies.
Cilium provides transparent network security for container applications using eBPF (extended Berkeley Packet Filter), a Linux kernel technology that enables high-performance, programmable data-path filtering without kernel module changes. Cilium allows you to define and enforce both network-layer (L3/L4) and HTTP-layer (L7) security policies based on container or pod identity rather than IP addresses.
Cilium leverages BPF for core data-path filtering, packet mangling, monitoring, and redirection. These capabilities require Linux kernel version 4.8.0 or newer.
6. CoreOS Clair
Homepage: https://coreos.com/clair/docs/latest/
License: Open Source.
Use Cases: Pre-production static vulnerability analysis, CVE newsfeed.
Clair is an open-source project for static vulnerability analysis of container images, supporting both AppC and Docker image formats. It periodically refreshes its vulnerability database from configured CVE data sources, indexes software packages found in container image layers, and alerts or blocks deployment when insecure software is detected.
Because analysis is static, containers are never executed during the scan — meaning you can detect threats before they reach a running system. Clair is the security engine powering the CoreOS Quay container registry.
7. Docker Capabilities and Resource Quotas (Built-in)
Homepage: https://www.docker.com
License: Open Source.
Use Cases: Runtime protection, resource-based denial-of-service prevention.
Docker’s built-in security primitives are frequently underutilized. Two in particular deserve attention:
- Control Groups (cgroups): A Linux kernel feature that limits the access processes and containers have to system resources — CPU, RAM, IOPS, and network bandwidth. Without cgroup limits, a single runaway container can starve other workloads on the same host.
- Linux Capabilities: Rather than granting containers full root access, capabilities allow you to remove specific privileges from the root account or grant narrowly scoped permissions to user accounts. For example, you can allow a container to bind to port 80 without granting it full network administration rights.
8. Docker Bench for Security
Homepage: https://github.com/docker/docker-bench-security
License: Open Source.
Use Cases: Compliance auditing, configuration baseline checking.
Docker Bench for Security is a shell script that checks for dozens of common best practices around deploying Docker containers in production. It is packaged as a Docker container itself, making it trivially easy to run — a single docker run command produces results for approximately 250 checks covering both running containers and the Docker host.
The tests are based on the CIS Docker Community Edition Benchmark and are suitable for assessing Docker CE and Docker Swarm deployments.
9. Dockscan
Homepage: https://github.com/kost/dockscan
License: Open Source.
Use Cases: Compliance auditing, lightweight configuration checks.
Dockscan is a lightweight Ruby script that analyzes Docker installations and running containers on both local and remote hosts. It can be run with a single command and generates HTML reports. Checks include whether resource limits are configured, whether containers are spawning excessive processes or have a high volume of modified files, and whether the Docker host is allowing containers to forward traffic directly to the host gateway.
10. Falco
Homepage: https://www.sysdig.org/falco/
License: Open Source.
Use Cases: Runtime anomaly detection, alerting, forensics.
Sysdig Falco is a behavioral monitoring tool that detects anomalous activity on Linux hosts using the Sysdig kernel instrumentation layer. Unlike enforcement tools such as Seccomp or AppArmor — which block syscalls at the kernel level — Falco runs in user space and uses a kernel module to intercept system calls, then evaluates them against a rich set of rules.
Because it operates in user space, Falco can integrate with external systems like Docker, Kubernetes, and Mesos to enrich alerts with container and orchestration metadata. Rules can target container-specific context, letting you monitor container behaviour without modifying or instrumenting the containers themselves. A default rules file ships with sensible out-of-the-box detections.
11. HashiCorp Vault
Homepage: https://www.vaultproject.io/
License: Free with commercial enterprise tier.
Use Cases: Secrets management, credential distribution, trust management.
HashiCorp Vault is a comprehensive secrets management platform covering passwords, TLS certificates, API keys, access tokens, and SSH credentials. Key features include time-based secret leases, fine-grained access control, dynamic on-the-fly secret generation, and key rolling (renewing encryption keys without losing access to data encrypted under old keys).
Vault maintains a detailed audit log of all secret access and manipulation, enabling operators to trace suspicious activity. In containerized environments — where software entities are constantly created and destroyed — secure, auditable secret distribution is a critical concern. Vault itself can be deployed as a Docker container.
12. NeuVector
Homepage: http://neuvector.com/
License: Commercial.
Use Cases: Real-time runtime protection, compliance and audit.
NeuVector focuses on real-time security at runtime, automatically profiling the behavior of applications, containers, and services to detect security escalations and anomalous activity. Privileged “enforcer” containers are deployed on each physical host with access to the local Docker daemon. NeuVector aims to be non-intrusive by performing automatic behavioral discovery to assist operators in designing appropriate security policies without requiring prior manual configuration.
13. Notary
Homepage: https://github.com/docker/notary
License: Open Source.
Use Cases: Trusted image publishing, supply chain integrity, tamper detection.
Image forgery and tampering is a significant supply-chain risk in Docker-based deployments. Notary is a tool for publishing and managing cryptographically signed, trusted collections of content. It allows you to define trusted publishers and create signed image collections — similar in concept to signed package repositories in traditional Linux distributions, but applied to Docker images.
Notary goals include guaranteeing image freshness (ensuring clients receive the most up-to-date, non-vulnerable version), trust delegation between users, and secure distribution even over untrusted transport channels or mirrors.
14. OpenSCAP
Homepage: https://www.open-scap.org/
License: Open Source.
Use Cases: Compliance auditing, formal security certification.
OpenSCAP provides a suite of automated audit tools that examine software configuration and known vulnerabilities using the NIST-certified Security Content Automation Protocol (SCAP). You can define custom rules and assertions, and routinely verify that deployed software meets your organization’s security standards.
The toolset is designed not only for security hardening but also for producing the formal documentation and reports needed to satisfy official compliance standards. For Docker environments, OpenSCAP provides the oscap-docker tool, which can audit both running containers and stopped (cold) images.
15. REMnux
Homepage: https://remnux.org/
License: Open Source.
Use Cases: Malware analysis, digital forensics.
REMnux is a security-focused Linux distribution based on Ubuntu, designed to assist malware analysts with reverse-engineering malicious software. It bundles a large collection of pre-installed analysis tools including Wireshark, ClamAV, tcpextract, Sysdig, and many others.
REMnux is intended as a self-contained forensics toolkit you can carry on a USB drive and deploy when you suspect a system has been compromised. Conveniently, the REMnux project also publishes many of its integrated tools as individual Docker containers, making difficult-to-install security applications immediately accessible.
16. SELinux
Homepage: https://selinuxproject.org
License: Open Source.
Use Cases: Runtime protection, Mandatory Access Control (MAC), role-based access control.
Security-Enhanced Linux (SELinux) is a Linux kernel security module providing mandatory access controls, mandatory integrity controls, role-based access control (RBAC), and type enforcement. It is frequently compared to AppArmor — both implement MAC — but SELinux is generally considered more powerful, flexible, and correspondingly more complex to configure.
In a Docker context, SELinux provides an additional layer of access policies to isolate the host from containerized applications, limiting the blast radius if a container is compromised.
17. Seccomp
Homepage: https://www.kernel.org
License: Open Source (Linux kernel feature).
Use Cases: Syscall filtering, runtime protection.
Seccomp (Secure Computing Mode) is a Linux kernel sandboxing facility rather than a standalone tool. It uses Berkeley Packet Filter (BPF) rules to filter system calls at the kernel level, functioning conceptually like an iptables firewall for syscalls. With Seccomp you can selectively allow or deny specific syscalls per container — for example, preventing any container from modifying file permissions.
Docker has integrated Seccomp support since Docker Engine version 1.10, using a JSON-based DSL to define profiles that are compiled to Seccomp filters. A detailed technical comparison of Seccomp, Falco, AppArmor, and SELinux is available on the Sysdig blog.
18. Sysdig
Homepage: https://www.sysdig.org/
License: Open Source, with commercial products built on the core technology.
Use Cases: System-level debugging, anomaly investigation, container forensics.
Sysdig is a full-system exploration and debugging tool for Linux. It captures all system calls made by all processes, enabling administrators to troubleshoot OS-level bugs or investigate unexpected process behaviour. The command-line interface uses syntax familiar to tcpdump users, and a ncurses-based UI (similar to htop) allows interactive navigation and filtering of events.
Critically for container security, Sysdig’s capture files allow you to perform post-mortem forensics on containers even after they have been deleted — a key capability in ephemeral containerized environments where evidence can disappear within minutes.
19. Tenable Flawcheck
Homepage: https://www.tenable.com/flawcheck
License: Commercial.
Use Cases: Pre-production image scanning, vulnerability detection in CI/CD pipelines.
Tenable — best known for the Nessus vulnerability scanner — acquired Flawcheck, a container-focused security solution. FlawCheck scans container images as they are built, before they reach production, leveraging Tenable’s existing vulnerability, malware, and intrusion detection knowledge base and adapting it to containerized, agile CI/CD workflows.
20. Twistlock
Homepage: https://www.twistlock.com/
License: Commercial.
Use Cases: Pre-production analysis, runtime protection, compliance and audit.
Twistlock is a commercial security suite purpose-built for containerized environments, covering vulnerability management, access control, analytics, forensics, and security standards compliance. It integrates directly into CI/CD pipelines through native plugins for popular tools such as Jenkins and TeamCity, as well as callable webhooks, so every build and test environment can trigger an automated image scan before reaching production.
Choosing the Right Tools for Your Environment
No single tool covers every threat vector. A layered approach is recommended:
- Image scanning (pre-production): Clair, Anchore, Black Duck, Aqua Security, Twistlock, Tenable Flawcheck
- Runtime protection and MAC: AppArmor, SELinux, Seccomp, NeuVector, Aqua Security, Twistlock
- Network security: Cilium
- Secrets management: HashiCorp Vault
- Compliance and auditing: Docker Bench for Security, OpenSCAP, Dockscan
- Behavioural monitoring and forensics: Falco, Sysdig, REMnux
- Trust and supply chain: Notary
Start with the built-in Docker primitives (cgroups, capabilities, Seccomp, AppArmor/SELinux), add image scanning to your CI/CD pipeline, and layer runtime monitoring and secrets management on top. Commercial platforms like Aqua Security and Twistlock can consolidate many of these functions if operational simplicity is a priority.