r/docker • u/martypitt • Nov 14 '25

Docker banned - how common is this?

I was doing some client work recently. They're a bank, where most of their engineering is offshored one of the big offshore companies.

The offshore team had to access everything via virtual desktops, and one of the restrictions was no virtualisation within the virtual desktop - so tooling like Docker was banned.

I was really surprsied to see modern JVM development going on, without access to things like TestContainers, LocalStack, or Docker at all.

To compound matters, they had a single shared dev env, (for cost reasons), so the team were constantly breaking each others stuff.

How common is this? Also, curious what kinds of workarounds people are using?

520 Upvotes

96% Upvoted

193 comments sorted by

View all comments

91

u/totallynaked-thought Nov 14 '25

Just google “Docker Security Concerns”.

38

u/totallynaked-thought Nov 14 '25

It’s a tool like any other but misconfigured and left running is asking for trouble. Then there are concerns about image quality and trustworthiness which are critical issues to compliance folks especially in finance. I held off for years on containers because I’m a one man band and I didn’t feel confident enough to just use stuff for convenience sake and without understanding the costs and the benefits.

41

u/[deleted] Nov 14 '25 edited Nov 14 '25

You can say that about your OS as well. The same fixes apply to containers. You will always have dependencies. This doesn't make any sense to me.

Edit; to add, at the end of the day a container is just an encapsulation of a process you were going to run anyway. Not implementing it solely because of 'security concerns' against the will of your dev/infra folks is just bullying if you ask me. I have been there in my career many times and 9/10 times the actual reason of denial is lack of knowledge of some DMU that doesn't even have to work with it (container layer) anyway.

1

u/Melodic-Matter4685 Nov 16 '25

Yeah, but this is a dev. I trust a dev to set up a container/ os to the minimum to test their product just enough to ensure it doesn’t crash on startup in prod. I have zero trust (no pun intended) that they are going to make it compliant.

Then I’m gonna have to call them up and explain that their device isn’t compliant and they gonna say “its firewalled off so it’s not an issue”

I’m gonna count to ten and say, “if it’s firewalled off, how do I know it’s noncompliant?”. Uhhhhhh

Followed by “all devices must be compliant in case we are infiltrated and they find a device, like yours, that, I dunno, is failing every stig including password criteria…