Before deploymentHost

Checklist: Docker host production readiness

11 items ·2 critical ·3 warn ·6 info

This checklist covers host configuration, daemon configuration, network configuration, security hardening, observability, and backup/DR. Run before any production deploy; update after every incident.

Procedure

For each item:

Run the command.
Confirm the output matches the expected.
If not, fix or document an exception.

Approval

Run this checklist quarterly. Track the score; fix FAILs; document WARNs.

Critical2 items

No accidental --privileged containers.
```
docker ps --filter privileged=true
```
No --pid=host containers.
```
docker ps --filter pid-mode=host
```

Warning3 items

Docker socket permissions: owned by root:docker, mode 0660.
```
ls -la /var/run/docker.sock
```
/var/lib/docker partition has ≥20% free space.
```
df -h /var/lib/docker
```
/var/lib/docker filesystem has ≥1M free inodes.
```
df -i /var/lib/docker
```

Info6 items

OS supported: Ubuntu 22.04 LTS or 24.04 LTS, Debian 12, RHEL 9, Rocky 9. Kernel 5.15+.
```
uname -r
```
Docker Engine installed via official repository, pinned to a specific major version.
```
docker --version
```
Docker daemon running under systemd.
```
systemctl status docker
```
Kernel modules loaded: overlay, br_netfilter, nf_nat.
```
lsmod | grep -E "(overlay|br_netfilter|nf_nat)"
```
IP forwarding enabled.
```
sysctl net.ipv4.ip_forward
```

Bridge netfilter enabled.

sysctl net.bridge.bridge-nf-call-iptables