Docker Bench Security

What Docker Bench Audits

Docker Bench for Security is a shell script that checks a Docker host against the CIS Docker Benchmark. It reads (never modifies) configuration across six groups: host OS hardening, the dockerd daemon config, files under /etc/docker, image and build hygiene, container runtime flags, and operational practice.

Each check prints PASS, WARN, or INFO with remediation guidance. Examples it catches: users in the docker group (effectively root), a world-readable docker.sock, the daemon API exposed without TLS, containers running as root, missing --cap-drop, and no resource limits. Because it only inspects state, it is safe to run on production hosts during a maintenance window.

Running It

Clone and run it directly on the host:

git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
sudo ./docker-bench-security.sh

The containerized form needs broad host visibility: mount /var/lib/docker, /etc, /var/run/docker.sock, and the containerd/runc/dockerd binaries, then add --net host --pid host --userns host --cap-add audit_control so it can read audit configuration.

Schedule it with cron or CI and archive the output as evidence. Rather than chasing every line, diff WARN results against a known baseline each release — that turns a point-in-time scan into a regression check.

Pitfalls and Interview Focus

Docker Bench audits the host, not your application code or image dependencies — pair it with image scanning (Trivy, scan-on-push) and runtime policy tooling for real coverage.

Common failure modes: running it without enough privileges yields incomplete or misleading results; hardened hosts using user namespaces or custom systemd units can trigger WARNs because the benchmark assumes default layouts; and a clean run today says nothing about a daemon restart tomorrow.

Interview angle: name two concrete CIS-backed controls you enforce — drop all capabilities and re-add only what is needed (--cap-drop ALL), enforce a non-root USER, enable live-restore so containers survive daemon restarts — then describe verifying them by trend-checking bench output in CI.