Docker Bench for Security

repository·master·Indexed 27 days ago

https://github.com/docker/docker-bench-security

An automated script that checks Docker hosts and containers against best practices defined in the CIS Docker Benchmark. It allows users to self-assess production environments for security compliance and can be executed directly from the base host or as a privileged container via Docker and Docker Compose.

Tokens: 2K
Snippets: 3
Records: 6
Agent score: 44%

What's inside docker-bench-security

Build and run Docker Bench for Security using Docker
master
Since the official docker/docker-bench-security image is out-of-date, you should build the image manually or use Docker Compose.
Note: The container runs with high privileges (sharing host's filesystem, pid, and network namespaces) to allow the benchmark to assess the running host.
https://github.com/docker/docker-bench-security/blob/master/README.md
Run Docker Bench for Security from your base host
master
You can run the security benchmark directly on your host machine by cloning the repository and executing the script with sudo.
Prerequisites:
- Docker version 1.13.0 or later.
- jq is an optional but recommended dependency for processing output.
Steps:
1. Clone the repository.
2. Navigate to the directory.
3. Run the script using sudo sh docker-bench-security.sh.
```
git clone https://github.com/docker/docker/docker-bench-security.git
cd docker-bench-security
sudo sh docker-bench-security.sh
```
https://github.com/docker/docker-bench-security/blob/master/README.md

Run the Docker Bench for Security container

master

To run the benchmark via a container, use the docker run command with specific flags to grant the necessary host access. You must adjust the shared volumes according to your operating system.

Standard Execution (Generic Linux):

docker run --rm --net host --pid host --userns host --cap-add audit_control \
    -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
    -v /etc:/etc:ro \
    -v /usr/bin/containerd:/usr/bin/containerd:ro \
    -v /usr/bin/runc:/usr/bin/runc:ro \
    -v /usr/lib/systemd:/usr/lib/systemd:ro \
    -v /var/lib:/var/lib:ro \
    -v /var/run/docker.sock:/var/run/docker.sock:ro \
    --label docker_bench_security \
    docker-bench-security

Ubuntu Specific (adjusting systemd paths):

docker run --rm --net host --pid host --userns host --cap-add audit_control \
    -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
    -v /etc:/etc:ro \
    -v /lib/systemd/system:/lib/systemd/system:ro \
    -v /usr/bin/containerd:/usr/bin/containerd:ro \
    -v /usr/bin/runc:/usr/bin/runc:ro \
    -v /usr/lib/systemd:/usr/lib/systemd:ro \
    -v /var/lib:/var/lib:ro \
    -v /var/run/docker.sock:/var/run/docker.sock:ro \
    --label docker_bench_security \
    docker-bench-security

macOS (Docker Desktop): Note: macOS lacks /etc/hostname (create it with sudo touch /etc/hostname) and does not have /usr/lib/systemd or the standard Docker binaries in those paths.

sudo touch /etc/hostname

docker run --rm --net host --pid host --userns host --cap-add audit_control \
    -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
    -v /etc:/etc \
    -v /var/lib:/var/lib:ro \
    -v /var/run/docker.sock:/var/run/docker.sock:ro \
    --label docker_bench_security \
    docker-bench-security

Run Docker Bench for Security using Docker Compose
master
You can use the provided docker-compose.yml to run the security benchmark. You have two options for initializing the service:
1. Build from source: Use the build: . configuration to have Docker Compose build the image from the local Dockerfile.
2. Use a pre-built image: If you have already built the image manually using docker build --rm -t docker-bench-security ., you can uncomment the image: docker-bench-security line in the configuration.
The service requires specific privileges and host access to perform security checks, including audit_control capabilities, host PID namespace access, and read-only mounts of critical host directories (/var/lib, /var/run/docker.sock, /usr/lib/systemd, and /etc).
```
services:
  docker-bench-security:
      # Option 1: Build from local Dockerfile
      build: .

      # Option 2: Use a pre-built image
      # image: docker-bench-security

      cap_add:
          - audit_control
      labels:
          - docker_bench_security
      pid: host
      stdin_open: true
      tty: true
      volumes:
          - /var/lib:/var/lib:ro
          - /var/run/docker.sock:/var/run/docker.sock:ro
          - /usr/lib/systemd:/usr/lib/systemd:ro
          - /etc:/etc:ro
```
https://github.com/docker/docker-bench-security/blob/master/docker-compose.yml
Filter Docker Bench for Security checks
master
You can run specific subsets of tests using the -c (include) and -e (exclude) flags.
Naming Convention:
- CIS-based checks: check_<section>_<number> (e.g., check_2_6).
- Community checks: check_c_<number>.
- Groups: Can be specified by name (e.g., container_images).
Examples:
- Run a single check: sh docker-bench-security.sh -c check_2_2
- Run all except one check: sh docker-bench-security.sh -e check_2_2
- Run all except a group: sh docker-bench-security.sh -e docker_enterprise_configuration
- Run multiple specific groups: sh docker-bench-security.sh -c container_images,container_runtime
- Run a group but exclude a specific check within it: sh docker-bench-security.sh -c container_images -e check_4_5
https://github.com/docker/docker-bench-security/blob/master/README.md
Configure Docker Bench for Security CLI options
master
The docker-bench-security.sh script accepts several flags to control the execution and output of the benchmark.
Available Flags:
- -b: Do not print colors
- -h: Print this help message
- -l FILE: Log output in FILE (if running in a container, logs are written to /usr/local/bin/log/ inside the container)
- -u USERS: Comma delimited list of trusted docker user(s)
- -c CHECK: Comma delimited list of specific check(s) id to include
- -e CHECK: Comma delimited list of specific check(s) id to exclude
- -i INCLUDE: Comma delimited list of patterns within a container or image name to check
- -x EXCLUDE: Comma delimited list of patterns within a container or image name to exclude from check
- -t LABEL: Comma delimited list of labels within a container or image to check
- -n LIMIT: In JSON output, limit the number of reported items (containers, images, etc.) to LIMIT. Default is 0 (no limit).
- -p PRINT: Disable the printing of remediation measures. Default is enabled.
```
  -b           optional  Do not print colors
  -h           optional  Print this help message
  -l FILE      optional  Log output in FILE, inside container if run using docker
  -u USERS     optional  Comma delimited list of trusted docker user(s)
  -c CHECK     optional  Comma delimited list of specific check(s) id
  -e CHECK     optional  Comma delimited list of specific check(s) id to exclude
  -i INCLUDE   optional  Comma delimited list of patterns within a container or image name to check
  -x EXCLUDE   optional  Comma delimited list of patterns within a container or image name to exclude from check
  -t LABEL     optional  Comma delimited list of labels within a container or image to check
  -n LIMIT     optional  In JSON output, when reporting lists of items (containers, images, etc.), limit the number of reported items to LIMIT. Default 0 (no limit).
  -p PRINT     optional  Disable the printing of remediation measures. Default: print remediation measures.
```
https://github.com/docker/docker-bench-security/blob/master/README.md