Docker Web UI Security in 2026: Who Actually Publishes a Threat Model

说明与用途

在选择支持 rootless 并具有透明威胁模型的安全 Docker UI 时，许多选项缺乏文档。研究发现，只有 Portainer 和 Rancher 提供完整文档和 rootless 支持，而 Dockhand 和 Arcane 提供有价值的安全工件。通过 TCP 暴露 Docker 并不能降低 root 访问风险。建议根据威胁概况而定。

问题

Choosing a Docker web UI with strong security, especially rootless support and documented threat models, is challenging because many options lack clear documentation or comprehensive security artifacts.

结果

The study revealed that only Portainer and Rancher provide comprehensive security documentation and rootless support. Dockhand and Arcane offer valuable security artifacts, while most other tools lack clear rootless guidance. Exposing Docker via TCP does not mitigate root access risk. Recommendations vary by threat model, from Portainer for home users to Rancher for enterprise Kubernetes deployments.

工作流

• 1. Review each UI’s official docs for rootless Docker support, authentication methods, security documentation, and CVE processes.
• 2. Compile findings into a comparison matrix.
• 3. Highlight gaps such as lack of rootless documentation and limited security artifacts.
• 4. Provide recommendations based on risk profiles (home, small company, client workloads, supply chain focus, IaC preference).
• 5. Update own project (Stacker) with a SECURITY.md and plan to add rootless docs.

证据

Only Portainer explicitly documents rootless Docker support (with caveats)

来源

Rootless mode is a separate daemon configuration – the only meaningful mitigation for the "UI compromise = host root" risk.

来源

Rancher publishes CIS Benchmark alignment, kube-bench, SELinux packages, and public pentest reports.

来源