<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Docker Daemon Configuration — API Reference

## Docker CLI

### Daemon Information

```bash
# Full daemon info
docker info
docker info --format json

# Version details
docker version --format json

# System disk usage
docker system df -v
```

### Daemon Configuration

```bash
# Default config path
/etc/docker/daemon.json

# Systemd unit file
systemctl cat docker.service
/lib/systemd/system/docker.service

# Override configuration
systemctl edit docker.service
```

### Key daemon.json Settings

| Setting | Secure Value | CIS Control |
|---------|-------------|-------------|
| `icc` | `false` | 2.1 |
| `log-level` | `"info"` | 2.2 |
| `iptables` | `true` | 2.3 |
| `insecure-registries` | `[]` | 2.4 |
| `userns-remap` | `"default"` | 2.6 |
| `live-restore` | `true` | 2.12 |
| `userland-proxy` | `false` | 2.13 |
| `no-new-privileges` | `true` | 2.14 |
| `storage-driver` | `"overlay2"` | 2.5 |

### Socket and TLS

```bash
# Check socket permissions
stat -c '%a %U %G' /var/run/docker.sock

# Enable TLS
dockerd --tlsverify \
  --tlscacert=ca.pem \
  --tlscert=server-cert.pem \
  --tlskey=server-key.pem \
  -H=0.0.0.0:2376

# Generate TLS certificates
openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
```

### Audit Rules

```bash
# Add auditd rules for Docker
-w /usr/bin/dockerd -k docker
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /lib/systemd/system/docker.service -k docker
-w /etc/docker/daemon.json -k docker
-w /var/run/docker.sock -k docker
```

## docker-bench-security

```bash
# Run full benchmark
docker run --rm --net host --pid host \
  --userns host --cap-add audit_control \
  -v /etc:/etc:ro -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  docker/docker-bench-security

# Run specific section
docker run --rm ... docker/docker-bench-security -c check_2
```

## CIS Docker Benchmark Sections

| Section | Area |
|---------|------|
| 1 | Host Configuration |
| 2 | Docker Daemon Configuration |
| 3 | Docker Daemon Configuration Files |
| 4 | Container Images and Build Files |
| 5 | Container Runtime |
| 6 | Docker Security Operations |
| 7 | Docker Swarm Configuration |
