Using Docker Bench for Security

Docker Bench for Security is a script that checks for common best practices around deploying Docker containers in production. It is based on the CIS Docker Benchmark and helps identify potential security issues in your Docker environment.

1. Installation

To use Docker Bench for Security, you first need to clone the repository and navigate to the directory:

git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security

2. Running the Security Checks

You can run the security checks directly from your host or using a Docker container. Here are both methods:

Method 1: Running from the Host

Run the following command to execute the script:

sudo sh docker-bench-security.sh

This command will execute the security checks and output the results directly to your terminal.

Method 2: Running in a Docker Container

The recommended way to run Docker Bench for Security is using the pre-built Docker container:

docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -v /etc:/etc:ro \
  -v /usr/bin/containerd:/usr/bin/containerd:ro \
  -v /usr/bin/runc:/usr/bin/runc:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --label docker_bench_security \
  docker/docker-bench-security

This command runs the Docker Bench for Security checks in a containerized environment, ensuring that it has the necessary permissions and access to the Docker socket.

3. Understanding the Output

After running the checks, Docker Bench for Security will provide output categorized into INFO, WARN, and PASS:

  • INFO: Indicates checks that are informational and do not require action.
  • WARN: Indicates potential issues that should be addressed to improve security.
  • PASS: Indicates checks that have passed and do not require any action.

Example Output

# Docker Bench for Security v1.3.6
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Based on the CIS Docker Benchmark 1.3.1.

[WARN] Some tests might require root to run
[INFO] 1 - Host Configuration
[WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated)

4. Conclusion

Using Docker Bench for Security is an effective way to audit your Docker environment and ensure that you are following best practices. Regularly running these checks can help you maintain a secure containerized environment.