Docker bench security
A script that checks for dozens of common best-practices around deploying Docker containers in production.
What is Docker bench security?
Docker Bench for Security is a script that automates security checks for Docker containers and hosts based on the CIS Docker Benchmark. It scans for dozens of common best-practices and misconfigurations in production deployments, helping teams ensure their Docker environments are secure and compliant. The tool provides both command-line and containerized execution options for flexible integration into workflows.
DevOps engineers, security professionals, and system administrators responsible for deploying and maintaining Docker containers in production environments. It is particularly useful for teams needing to comply with security standards or perform regular security audits.
Developers choose Docker Bench for Security because it provides a free, open-source alternative to commercial security scanners, with direct alignment to the industry-standard CIS benchmarks. Its simplicity, automation, and community-driven updates make it a practical tool for continuous security assessment.
Overview
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
Use Cases
Best For
- Auditing Docker host configurations against CIS benchmarks
- Checking production container deployments for security misconfigurations
- Integrating security scanning into CI/CD pipelines for Dockerized applications
- Preparing for compliance audits (e.g., SOC2, HIPAA) related to container security
- Educating teams on Docker security best practices through automated checks
- Self-hosting security assessments without relying on SaaS tools
Not Ideal For
- Environments using container runtimes other than Docker, such as Podman or containerd without Docker Engine
- Teams requiring real-time, automated remediation instead of periodic security scans
- Organizations that prefer pre-built, up-to-date container images without manual compilation
- Projects with highly customized Docker setups where CIS benchmarks may not directly apply
Pros & Cons
Pros
Runs automated tests based on the CIS Docker Benchmark v1.6.0, ensuring industry-standard security checks without manual configuration, as highlighted in the key features.
Can be run directly from the host or as a Docker container for isolated testing, with detailed commands provided for both methods in the README, including Docker Compose support.
Supports including or excluding specific checks by ID or category (e.g., using -c for container_images), allowing targeted assessments as described in the options section.
Generates JSON and plain-text logs with options to disable colors or remediation printouts, facilitating integration into automated workflows and audit trails.
Cons
The README admits the docker/docker-bench-security image is out-of-date and requires manual building, referencing issue #405, which adds setup overhead for users.
Running the tool requires adjusting volume mounts and commands based on the OS, such as different examples for Ubuntu and macOS, making deployment error-prone.
Focuses solely on Docker hosts and containers, so it's not applicable for other container runtimes like Podman, reducing its utility in diverse environments.
Provides point-in-time assessments without built-in continuous monitoring or remediation, which may not catch dynamic security issues in production.
Frequently Asked Questions
Related Projects
trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
gvisorApplication Kernel for Containers
GrypeA vulnerability scanner for container images and filesystems
GrypeA vulnerability scanner for container images and filesystems
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.