Docker Web UI Security in 2026: Who Actually Publishes a Threat Model

Описание и применение

Выбор безопасного Docker‑UI с поддержкой rootless и прозрачной архитектурой угроз сложен, поскольку большинство решений не документируют эти аспекты. Исследование выявило, что только Portainer и Rancher предлагают полноценную документацию и поддержку rootless, а Dockhand и Arcane предоставляют ценные артефакты безопасности. Экспонирование Docker через TCP не снижает риск получения root‑доступа. Рекомендации зависят от профиля угроз.

Задача

Choosing a Docker web UI with strong security, especially rootless support and documented threat models, is challenging because many options lack clear documentation or comprehensive security artifacts.

Результат

The study revealed that only Portainer and Rancher provide comprehensive security documentation and rootless support. Dockhand and Arcane offer valuable security artifacts, while most other tools lack clear rootless guidance. Exposing Docker via TCP does not mitigate root access risk. Recommendations vary by threat model, from Portainer for home users to Rancher for enterprise Kubernetes deployments.

Рабочий процесс

• 1. Review each UI’s official docs for rootless Docker support, authentication methods, security documentation, and CVE processes.
• 2. Compile findings into a comparison matrix.
• 3. Highlight gaps such as lack of rootless documentation and limited security artifacts.
• 4. Provide recommendations based on risk profiles (home, small company, client workloads, supply chain focus, IaC preference).
• 5. Update own project (Stacker) with a SECURITY.md and plan to add rootless docs.

Доказательства

Only Portainer explicitly documents rootless Docker support (with caveats)

Источник

Rootless mode is a separate daemon configuration – the only meaningful mitigation for the "UI compromise = host root" risk.

Источник

Rancher publishes CIS Benchmark alignment, kube-bench, SELinux packages, and public pentest reports.

Источник