Measuring Configuration Security With Docker Bench

Last week we looked at the Docker defaults for keeping your app more secure, but today’s newsletter is going to cover benchmarking of your Docker hosts configuration as well, to scan for security best practices.

Today we are focused on Docker Bench. This scanning tool can be run as a Docker container so the test can be spun up and run very quickly. I cover this benchmark tool in my recent YouTube Live show where I listed my security best practices.

By granting the bench container high levels of privilege to the host file system, network namespaces, and more, the container executes a scan to run all available CIS tests on the host, and will also output logs in the current directory. By running these tests, we can see how we stand up against the standards set by the Center for Internet Security.

The container can be run with the following docker run command:

You might notice this container is highly privileged and requires a lot of access. You’re right, but this access is only to determine how safe your setup is. It’s a one-time run, and will stop when finished. You also might need to tweak your volumes in the command provided based on your OS and filesystem type. Also in that command come options for colored text, or exporting the results to a log file, or even exclusion options to skip a certain check.

Thanks for reading,

–Bret

Weekly YouTube Live: bretfisher.com/youtube

Course Coupons: bretfisher.com/courses

Podcast: bretfisher.com/podcast

Twitter: twitter.com/bretfisher