CIS Docker Benchmark
An InSpec compliance profile that automates security testing for Docker daemon and containers against CIS benchmarks.
What is CIS Docker Benchmark?
CIS Docker Benchmark - InSpec Profile is an open-source compliance tool that automates security testing for Docker environments. It implements the CIS Docker Benchmark as executable InSpec code to validate that Docker daemon and container configurations adhere to security best practices. The tool helps organizations maintain secure Docker deployments by providing automated, repeatable checks.
DevOps engineers, security teams, and system administrators responsible for securing Docker containers in production environments. It's particularly useful for organizations that need to comply with security standards or perform regular security audits.
Developers choose this tool because it automates manual CIS benchmark checks, saving time and reducing human error. Its integration with InSpec allows for easy incorporation into existing CI/CD pipelines and infrastructure testing workflows.
Overview
CIS Docker Benchmark - InSpec Profile
Use Cases
Best For
- Automating CIS Docker Benchmark compliance checks in CI/CD pipelines
- Performing security audits on Docker daemon configurations
- Hardening Docker container security in production environments
- Integrating security testing into DevOps workflows
- Validating Docker security settings across multiple hosts
- Running targeted security checks for specific CIS controls
Not Ideal For
- Teams using container runtimes other than Docker (e.g., Podman, containerd)
- Organizations with Docker deployments on unsupported operating systems like Windows or newer Linux distributions
- Projects that require automated remediation of security issues, as this tool only provides testing
Pros & Cons
Pros
Implements the CIS Docker 1.13.0 Benchmark as executable InSpec code, enabling automated and repeatable security checks that save time and reduce human error.
Supports YAML attribute files to customize Docker settings such as trusted users, logging drivers, and registry certificates, making it adaptable to specific environment needs.
Allows running tests on remote hosts via SSH and executing individual controls (e.g., specific benchmark checks), providing operational flexibility and focused audits.
Built on InSpec, it can be easily incorporated into CI/CD pipelines for continuous security validation, as shown in the usage examples for local and remote execution.
Cons
Only supports older OS versions like Debian 8, Ubuntu 16.04, and CentOS 7, which may not align with current production environments using newer distributions.
Requires InSpec 2.3.23+ and familiarity with its framework, adding a learning curve and toolchain dependency that might not fit teams outside the Chef ecosystem.
Based on CIS Docker 1.13.0, which might not cover security recommendations for newer Docker versions, reducing its relevance over time despite the benchmark_version attribute for older controls.
Frequently Asked Questions
Related Projects
trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
GrypeA vulnerability scanner for container images and filesystems
ClairVulnerability Static Analysis for Containers
Docker bench securityThe Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.