Part 2: Docker Containerization and Certificate-Based Security

Enterprise Hyper-V Containerization with Docker, Isolation Networks, and High-Performance NAS

Part 2: Docker Containerization and Certificate-Based Security

Author: Virtology – https://virtology.blogspot.com/
Series Overview:
In Part 1, we built a secure and high-performance Hyper-V foundation. Now we’ll layer Docker containerization on top, configuring Hyper-V isolation, TLS certificate management, and network security. This ensures a containerized workload model that meets enterprise-grade standards for performance, compliance, and security.

1. Understanding Docker on Windows Server with Hyper-V

Docker on Windows Server supports two isolation modes: process isolation and Hyper-V isolation.

Process isolation: Containers share the host kernel, offering speed and lower resource overhead but less security boundary.
Hyper-V isolation: Each container runs within a lightweight virtual machine, providing full kernel isolation — ideal for multi-tenant or production environments.

Best Practice:
Always use Hyper-V isolation in enterprise environments, especially where untrusted or mixed-version containers are deployed. It ensures strong security separation between containers and the host OS.

Microsoft Reference:
https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container

2. Installing Docker on Windows Server

Ensure Windows Server 2022 Datacenter is fully patched and Hyper-V is already installed (as configured in Part 1).

Install Docker via PowerShell:


Install-Module -Name DockerMsftProvider -Repository PSGallery -Force
Install-Package -Name docker -ProviderName DockerMsftProvider -Force
Restart-Computer -Force

Verify installation:


docker version
docker info

Best Practice:
Run Docker as a service account with limited privileges.
Example:


New-LocalUser -Name "svc_docker" -Password (Read-Host -AsSecureString)
Add-LocalGroupMember -Group "Administrators" -Member "svc_docker"

Then configure the Docker service to log in as this account for better audit traceability.

3. Configuring Docker for Hyper-V Isolation

To ensure all containers launch using Hyper-V isolation by default, edit the daemon.json configuration file.

Path: C:\ProgramData\Docker\config\daemon.json

Configuration Example:


{
  "exec-opts": ["isolation=hyperv"],
  "data-root": "D:\\DockerData",
  "tls": true,
  "tlsverify": true,
  "tlscacert": "C:\\ProgramData\\Docker\\certs\\ca.pem",
  "tlscert": "C:\\ProgramData\\Docker\\certs\\server-cert.pem",
  "tlskey": "C:\\ProgramData\\Docker\\certs\\server-key.pem",
  "hosts": ["tcp://0.0.0.0:2376", "npipe://"]
}

Restart Docker:


Restart-Service docker

Why:

isolation=hyperv enforces per-container VM boundaries.
data-root separates container data from the OS drive for better performance and easier backup.
TLS settings ensure all Docker API communications are encrypted.

4. Setting Up TLS Certificates for Docker

Goal: Secure all Docker client-to-daemon communication using TLS.

a. Generate Certificates Using PowerShell

Create a Certificate Authority (CA):


$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "Virtology-CA"
Export-Certificate -Cert $cert -FilePath C:\certs\ca.pem

Create a Server Certificate:


$serverCert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "hyperv-docker.virtology.local" -Signer $cert
Export-PfxCertificate -Cert $serverCert -FilePath C:\certs\server.pfx -Password (ConvertTo-SecureString -String "P@ssw0rd" -Force -AsPlainText)

Create a Client Certificate:


$clientCert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "docker-client.virtology.local" -Signer $cert
Export-PfxCertificate -Cert $clientCert -FilePath C:\certs\client.pfx -Password (ConvertTo-SecureString -String "P@ssw0rd" -Force -AsPlainText)

Distribute Certificates:
- Copy the CA certificate and client certificate to trusted systems.
- Protect private keys with file permissions and encrypted storage.

Best Practice:
Use an internal PKI or Active Directory Certificate Services (ADCS) in production to automate renewal and revocation. Avoid self-signed certificates beyond lab environments.

Microsoft Reference:
https://learn.microsoft.com/en-us/windows-server/security/transport-layer-security-overview

5. Hardening the Docker Daemon

a. Disable Unsecured Endpoints

Ensure the Docker daemon does not listen on unencrypted TCP sockets:


Get-Content C:\ProgramData\Docker\config\daemon.json

Only tcp://0.0.0.0:2376 with TLS should appear — never port 2375.

b. Enable Logging

Add this line to daemon.json:


"log-driver": "json-file",
"log-opts": {
  "max-size": "100m",
  "max-file": "5"
}

This prevents log sprawl from exhausting disk space.

c. Enforce Least Privilege

Use group-based access control:


icacls "C:\ProgramData\Docker" /grant "svc_docker:(OI)(CI)F"

Revoke access from general administrators who don’t need Docker control.

6. Setting Up a Private Container Registry with TLS

For enterprises, local container images should be stored internally to prevent dependency on public registries.

Steps:

Create Registry Directory:
```
mkdir D:\DockerRegistry
```

Run Docker Registry Container:


docker run -d -p 5000:5000 --restart=always --name registry `
-v D:\DockerRegistry:/var/lib/registry `
-v C:\certs:/certs `
-e REGISTRY_HTTP_ADDR=0.0.0.0:5000 `
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server-cert.pem `
-e REGISTRY_HTTP_TLS_KEY=/certs/server-key.pem `
registry:2

Push and Pull Images:


docker tag mcr.microsoft.com/windows/servercore:ltsc2022 hyperv-docker.virtology.local:5000/servercore:ltsc2022
docker push hyperv-docker.virtology.local:5000/servercore:ltsc2022

Best Practice:
Implement container image signing using Notary or Docker Content Trust to ensure integrity during deployment.

Microsoft Reference:
https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/container-security

7. Windows Firewall and Network Security

By default, Docker opens ports for API and registry traffic. Harden this configuration with explicit rules.

Example PowerShell Firewall Configuration:


New-NetFirewallRule -DisplayName "Allow Docker TLS" -Direction Inbound -Protocol TCP 
-LocalPort 2376 -Action Allow
New-NetFirewallRule -DisplayName "Allow Private Registry" -Direction Inbound -Protocol TCP 
-LocalPort 5000 -Action Allow
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block 
-DefaultOutboundAction Allow

Best Practice:

Allow inbound access only from trusted subnets (management VLANs).
Use IPsec or Windows Defender Firewall with Advanced Security for encrypted host-to-host communication.
Implement Network Isolation Policies via Group Policy for Docker container networks.

8. Monitoring and Logging Container Activity

Integrate Docker logs into centralized monitoring for auditing and compliance.

Options:

Windows Event Forwarding (WEF): Collect Docker daemon logs.
Graylog/Splunk/Sentinel: Forward logs via Syslog or API.
Audit Policy:
Enable “Audit Process Creation” and “Audit Logon Events” in local security policy.

PowerShell Command Example:


auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

Best Practice:
Correlate Docker daemon logs, container process creation, and user login data to detect privilege escalation or unauthorized access attempts.

9. Summary

At the end of Part 2, your environment now supports:

Enterprise-grade Docker deployment on Windows Server
Containers running in Hyper-V isolation for strong security boundaries
Fully TLS-encrypted Docker communications
Private registry for internal image management
Hardened daemon and firewall configuration
Centralized logging and audit visibility

In Part 3, we’ll design isolation networks, configure firewalls and VLANs, and integrate a 40TB all-flash NAS array using RDMA and SMB 3.1.1 for maximum IOPS and low latency.

References and Further Reading

Microsoft Learn – Windows Containers:
https://learn.microsoft.com/en-us/virtualization/windowscontainers/
Docker Engine Security:
https://docs.docker.com/engine/security/
Microsoft Transport Layer Security Overview:
https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/security/enable-tls-1-2
Windows Firewall with Advanced Security:
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security
Docker Content Trust:
https://docs.docker.com/engine/security/trust/

Published by Virtology
Exploring virtualization, performance tuning, and secure enterprise design.
Visit: https://virtology.blogspot.com/

Virtology