dokku-security-hardening

Dokku security hardening (DevSecOps)

Version: Dokku 0.37.x. Safety: the audit commands below are read-only. Every hardening change (ssh-keys:add/remove, docker-options:add/remove, ports:*, cleanup, registry:login) can break deploys or running apps — review on staging and confirm with the operator before applying. Items beyond documented Dokku behavior are labelled (recommendation).

1. Deploy-key audit — who can push code?

dokku ssh-keys:list                     # read-only: every authorized deploy key
dokku ssh-keys:list --format json
dokku ssh-keys:add <name> /path/to/key  # add a named key (confirm)
dokku ssh-keys:remove <name>            # revoke (confirm)

(recommendation) One named key per person/CI system; remove keys for departed users/decommissioned pipelines. Treat this list as your deploy-access ACL.

2. Container privilege restriction (docker-options)

dokku docker-options:report <app>       # read-only: current run/build/deploy flags
dokku docker-options:add <app> deploy,run "--security-opt=no-new-privileges"
dokku docker-options:add <app> deploy,run "--cap-drop=ALL"
dokku docker-options:add <app> deploy,run "--read-only"
dokku docker-options:remove <app> <phase(s)> "<flag>"

(recommendation) For internet-facing apps, drop all Linux capabilities, set no-new-privileges, and consider a read-only root filesystem (mount writable paths via the storage plugin). Test each flag on staging — --read-only and --cap-drop=ALL break apps that write to disk or need specific capabilities.

3. Port exposure

dokku ports:report <app>                # read-only

(recommendation) Serve apps only through the proxy (http:80/https:443 → container port). Avoid ports:add of arbitrary host ports unless a non-HTTP service genuinely needs it; each extra host port is attack surface. Sweep the fleet and question any non-80/443 host port.

4. TLS & secret hygiene

• Enforce HTTPS on every public app (see dokku-tls-letsencrypt); redirect HTTP→HTTPS at the proxy or via the redirect plugin.
• Audit config keys without exposing values (see dokku-config-secrets): dokku config:keys <app>.
• (recommendation) Keep real secrets out of Dockerfiles, build args, and image layers — inject at runtime with config:set.

5. Private registry auth

dokku registry:report <app>             # read-only
dokku registry:login --password-stdin --global <server> <user>   # creds via stdin, not argv

(recommendation) Pass credentials via --password-stdin so they don't land in shell history or the process list.

6. Audit trail

dokku events:list                       # read-only: history of dokku commands

(recommendation) Keep events enabled and ship the audit trail off-host (see dokku-logs-events-trace). Ensure dokku trace:off in production — trace output can leak secrets.

7. Reduce image attack surface

dokku cleanup                           # remove exited containers + dangling images (confirm)

Audit-first workflow

1. Run all read-only reports above and summarize findings to the operator.
2. Propose specific hardening changes with their blast radius.
3. Apply on staging, verify the app still deploys and serves, then production.