View profile

Measuring Configuration Security With Docker Bench

Bret Fisher
Bret Fisher
Last week we looked at the Docker defaults for keeping your app more secure, but today’s newsletter is going to cover benchmarking of your Docker hosts configuration as well, to scan for security best practices.

Real-Time Docker Monitoring
Measuring Docker's Configuration Security
Today we are focused on Docker Bench. This scanning tool can be run as a Docker container so the test can be spun up and run very quickly. I cover this benchmark tool in my recent YouTube Live show where I listed my security best practices.
Host Configuration Benchmarking (Starts at 25:30)
GitHub - docker/docker-bench-security: Benchmark for Security
How Does it work?
By granting the bench container high levels of privilege to the host file system, network namespaces, and more, the container executes a scan to run all available CIS tests on the host, and will also output logs in the current directory. By running these tests, we can see how we stand up against the standards set by the Center for Internet Security.
CIS Docker Benchmarks - CIS
How Do I Run it?
The container can be run with the following docker run command:
For a copy/paste-able command, see the GitHub repo in the links above
For a copy/paste-able command, see the GitHub repo in the links above
You might notice this container is highly privileged and requires a lot of access. You’re right, but this access is only to determine how safe your setup is. It’s a one-time run, and will stop when finished. You also might need to tweak your volumes in the command provided based on your OS and filesystem type. Also in that command come options for colored text, or exporting the results to a log file, or even exclusion options to skip a certain check.
Thanks for reading,
–Bret
Weekly YouTube Live: bretfisher.com/youtube
Course Coupons: bretfisher.com/courses
Did you enjoy this issue? Yes No
Bret Fisher
Bret Fisher @bretfisher

Commentary on tools and techniques I find interesting around Docker, Kubernetes, Cloud Native DevOps, and DevSecOps.

In order to unsubscribe, click here.
If you were forwarded this newsletter and you like it, you can subscribe here.
Created with Revue by Twitter.
Bret Fisher, Virginia Beach, Virginia, USA