Last week we looked at the Dockerdefaults for keeping your app more secure, but today’s newsletter is going to cover benchmarking of your Docker hosts configuration as well, to scan for security best practices.
This weeks sponsor: Enhance visibility into the performance of your entire containerized environment and investigate issues quickly with Datadog. Optimize horizontal auto-scaling with high-granularity metrics and easily detect clusters over or under-allocating available resources via the auto-generated container map. Try monitoring your Docker containers with Datadogand they’ll send you a free t-shirt!
Today we are focused on Docker Bench. This scanning tool can be run as a Docker container so the test can be spun up and run very quickly. I cover this benchmark tool in my recent YouTube Live showwhere I listed my security best practices.
By granting the bench container high levels of privilege to the host file system, network namespaces, and more, the container executes a scan to run all available CIS tests on the host, and will also output logs in the current directory. By running these tests, we can see how we stand up against the standards set by the Center for Internet Security.
For a copy/paste-able command, see the GitHub repo in the links above
You might notice this container is highly privileged and requires a lot of access. You’re right, but this access is only to determine how safe your setup is. It’s a one-time run, and will stop when finished. You also might need to tweak your volumes in the command provided based on your OS and filesystem type. Also in that command come options for colored text, or exporting the results to a log file, or even exclusion options to skip a certain check.
