docker-bench-security

Docker Bench for Security is a shell script that automates dozens of security checks for Docker hosts and containers, based on the CIS Docker Benchmark v1.6.0. It is designed to help the Docker community easily self-assess their environments against this widely recognized security benchmark. The tool can be run directly from the base host or via a Docker container. When run directly, it requires Docker 1.13.0 or later. The containerized version needs extensive privileges (host network, PID, user namespace, and audit control capabilities) and mounts critical host directories to perform its checks. Key features include: - Automated checks covering host configuration, daemon configuration, container images, runtime, and more - Options to run specific checks (`-c`), exclude checks (`-e`), filter by container/image patterns (`-i`, `-x`), and limit output (`-n`) - JSON and plain text log output - Color-coded terminal output (can be disabled with `-b`) - Remediation measures for each failed check (can be disabled with `-p`) Checks are named systematically (e.g., `check_2_2` for logging level, `check_4_5` for content trust), and community-contributed checks are prefixed with `check_c_`. The script supports running individual checks or groups, and excluding specific ones. Note that the official Docker image is out-of-date, so manual building from source is recommended. The tool is intended for security assessment and should be used with an understanding of the underlying Docker and system configuration.