docker-bench-security

Docker Bench for Security is a shell script that automates dozens of security checks for Docker hosts and containers, based on CIS Docker Benchmark v1.6.0. It enables the Docker community to self-assess their environments against this widely recognized benchmark. The tool can run directly on the host (requires Docker 1.13.0+) or inside a container, which needs extensive privileges and mounts critical host directories. Key features include automated checks for host, daemon, images, runtime; options to run specific checks, exclude checks, filter by patterns, limit output; JSON and plain text logs; color‑coded terminal output; and remediation steps for failures. Checks are systematically named (e.g., check_2_2 for logging level) and community‑contributed checks are prefixed with check_c_. The official Docker image is outdated, so manual build from source is recommended. Use it for security assessment with an understanding of Docker and system configuration.