View profile

Measuring Configuration Security With Docker Bench

Last week we looked at the Docker defaults for keeping your app more secure, but today's newsletter i
Measuring Configuration Security With Docker Bench
By Bret Fisher • Issue #18 • View online
Last week we looked at the Docker defaults for keeping your app more secure, but today’s newsletter is going to cover benchmarking of your Docker hosts configuration as well, to scan for security best practices.

Real-Time Docker Monitoring
Measuring Docker's Configuration Security
Today we are focused on Docker Bench. This scanning tool can be run as a Docker container so the test can be spun up and run very quickly. I cover this benchmark tool in my recent YouTube Live show where I listed my security best practices.
Host Configuration Benchmarking (Starts at 25:30)
GitHub - docker/docker-bench-security: Benchmark for Security
How Does it work?
By granting the bench container high levels of privilege to the host file system, network namespaces, and more, the container executes a scan to run all available CIS tests on the host, and will also output logs in the current directory. By running these tests, we can see how we stand up against the standards set by the Center for Internet Security.
CIS Docker Benchmarks - CIS
How Do I Run it?
The container can be run with the following docker run command:
For a copy/paste-able command, see the GitHub repo in the links above
For a copy/paste-able command, see the GitHub repo in the links above
You might notice this container is highly privileged and requires a lot of access. You’re right, but this access is only to determine how safe your setup is. It’s a one-time run, and will stop when finished. You also might need to tweak your volumes in the command provided based on your OS and filesystem type. Also in that command come options for colored text, or exporting the results to a log file, or even exclusion options to skip a certain check.
Thanks for reading,
–Bret
Weekly YouTube Live: bretfisher.com/youtube
Course Coupons: bretfisher.com/courses
Did you enjoy this issue?
Bret Fisher

Frequent updates on my projects, videos, and opinions focused on the container ecosystem, including Docker, Kubernetes, Docker Swarm, CI/CD, and container DevOps.

If you don't want these updates anymore, please unsubscribe here.
If you were forwarded this newsletter and you like it, you can subscribe here.
Powered by Revue
Bret Fisher, Virginia Beach, Virginia, USA