...

Specific privileges can be assigned to select containers running capabilities. This is similar to running a packet sniffer such as Wireshark (tshark) as an un-elevated Linux user.

...

Top 3 security concerns

Privileged workstations or servers

Any docker host (such as a developer or DevOps workstation) which can (or does) run Docker containers as root is a privileged workstation or server. It can also mount the host operating system root and persist changes.

...

Solutions: rootless Docker

Software vulnerabilities

Any security vulnerability that’s reachable from the ENTRYPOINT

...

Solutions: Application Security including Supply-Chain security including SCA (Software Composition Analysis)

Secrets management and omni-capable automation systems

A container gets instantiated with environment secrets (which allow access to confidential, business or proprietary data). The environment secrets can be widely accessible, and often get supplied from omni-capable automation systems, which allow full end-to-end control over production from one single system.

Solutions: CI / CD with secure secrets management, CI and (Micro-)service architecture with segregation

Handy snippets

List dockerized processes

...