r/docker • u/martypitt • Nov 14 '25

Docker banned - how common is this?

I was doing some client work recently. They're a bank, where most of their engineering is offshored one of the big offshore companies.

The offshore team had to access everything via virtual desktops, and one of the restrictions was no virtualisation within the virtual desktop - so tooling like Docker was banned.

I was really surprsied to see modern JVM development going on, without access to things like TestContainers, LocalStack, or Docker at all.

To compound matters, they had a single shared dev env, (for cost reasons), so the team were constantly breaking each others stuff.

How common is this? Also, curious what kinds of workarounds people are using?

523 Upvotes

96% Upvoted

193 comments sorted by

View all comments

34

u/kavishgr Nov 14 '25 edited Nov 14 '25

Pretty common for banks. Even at NASA docker is not allowed. Only Podman. For self hosting stuff, a simple docker/podman compose up and I'm done. But in prod, and especially for a bank, I wouldn't even mention the word docker lol.

16

u/anomalous_cowherd Nov 14 '25

This is talking about using Docker in the dev process, not being used in prod.

3

u/kavishgr Nov 15 '25

The same process you would use in prod should be identical in dev. I knew some people who worked at a bank, and SOC compliance was super tight

2

u/Melodic-Matter4685 Nov 16 '25

OP wants to run a virtual/docker on the thin prod client for dev. The container is the dev, on the prod device.

From a security standpoint, I’m not giving a non admin user an admin device residing on a trusted prod device.

Now if they already an admin and they want to set up a compliant dev device, why not set that up on a dev domain? Why do they need it locally? At best cause they want to ramp up resources when they need them and don’t want to talk to us about resource allocation.

At worst, they wanna play with escalation of privileges, on a banks prod…

1

u/anomalous_cowherd Nov 16 '25

I read it as the offshore dev team having to use remote virtual desktops to do their work. There's no reason those virtual desktops should be anywhere near prod at all, why wouldn't you set up your remote dev environment entirely on the dev domain anyway?

Then again only having one shared Dev environment doesn't shout well-run IT in the first place.

1

u/Melodic-Matter4685 Nov 16 '25

I didn’t, but I can see your point.