GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2024-11-01 08:31:44 +01:00
Code Issues Projects Releases Packages Wiki Activity

initial commit of tests/6_docker_security_operations.sh v1.3.1

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2021-05-25 20:49:46 +02:00
parent bd05445528
commit 3a9deae328
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
tests/6_docker_security_operations.sh
View file

@ -1,4 +1,4 @@
#!/bin/sh
#!/bin/bash
check_6() {
logit ""
@ -11,16 +11,16 @@ check_6() {
check_6_1() {
local id="6.1"
local desc="Ensure that image sprawl is avoided (Not Scored)"
local desc="Ensure that image sprawl is avoided (Manual)"
local remediation="You should keep only the images that you actually need and establish a workflow to remove old or stale images from the host. Additionally, you should use features such as pull-by-digest to get specific images from the registry."
local remediationImpact="docker system prune -a removes all exited containers as well as all images and volumes that are not referenced by running containers, including for UCP and DTR."
local check="$id - $desc"
local check="$id - $desc"
starttestjson "$id" "$desc"
images=$(docker images -q | sort -u | wc -l | awk '{print $1}')
active_images=0
for c in $(docker inspect --format "{{.Image}}" $(docker ps -qa) 2>/dev/null); do
for c in $(docker inspect --format "{{.Image}}" "$(docker ps -qa)" 2>/dev/null); do
if docker images --no-trunc -a | grep "$c" > /dev/null ; then
active_images=$(( active_images += 1 ))
fi
@ -37,10 +37,10 @@ check_6_1() {
check_6_2() {
local id="6.2"
local desc="Ensure that container sprawl is avoided (Not Scored)"
local desc="Ensure that container sprawl is avoided (Manual)"
local remediation="You should periodically check your container inventory on each host and clean up containers which are not in active use with the command: docker container prune"
local remediationImpact="You should retain containers that are actively in use, and delete ones which are no longer needed."
local check="$id - $desc"
local check="$id - $desc"
starttestjson "$id" "$desc"
total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}')