GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

initial commit of tests/6_docker_security_operations.sh v1.3.1

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2021-05-25 20:49:46 +02:00
parent bd05445528
commit 3a9deae328
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
tests/6_docker_security_operations.sh
View file

@ -1,4 +1,4 @@
#!/bin/sh #!/bin/bash
check_6() { check_6() {
logit "" logit ""
@ -11,16 +11,16 @@ check_6() {
check_6_1() { check_6_1() {
local id="6.1" local id="6.1"
local desc="Ensure that image sprawl is avoided (Not Scored)" local desc="Ensure that image sprawl is avoided (Manual)"
local remediation="You should keep only the images that you actually need and establish a workflow to remove old or stale images from the host. Additionally, you should use features such as pull-by-digest to get specific images from the registry." local remediation="You should keep only the images that you actually need and establish a workflow to remove old or stale images from the host. Additionally, you should use features such as pull-by-digest to get specific images from the registry."
local remediationImpact="docker system prune -a removes all exited containers as well as all images and volumes that are not referenced by running containers, including for UCP and DTR." local remediationImpact="docker system prune -a removes all exited containers as well as all images and volumes that are not referenced by running containers, including for UCP and DTR."
local check="$id - $desc" local check="$id - $desc"
starttestjson "$id" "$desc" starttestjson "$id" "$desc"
images=$(docker images -q | sort -u | wc -l | awk '{print $1}') images=$(docker images -q | sort -u | wc -l | awk '{print $1}')
active_images=0 active_images=0
for c in $(docker inspect --format "{{.Image}}" $(docker ps -qa) 2>/dev/null); do for c in $(docker inspect --format "{{.Image}}" "$(docker ps -qa)" 2>/dev/null); do
if docker images --no-trunc -a | grep "$c" > /dev/null ; then if docker images --no-trunc -a | grep "$c" > /dev/null ; then
active_images=$(( active_images += 1 )) active_images=$(( active_images += 1 ))
fi fi
@ -37,10 +37,10 @@ check_6_1() {
check_6_2() { check_6_2() {
local id="6.2" local id="6.2"
local desc="Ensure that container sprawl is avoided (Not Scored)" local desc="Ensure that container sprawl is avoided (Manual)"
local remediation="You should periodically check your container inventory on each host and clean up containers which are not in active use with the command: docker container prune" local remediation="You should periodically check your container inventory on each host and clean up containers which are not in active use with the command: docker container prune"
local remediationImpact="You should retain containers that are actively in use, and delete ones which are no longer needed." local remediationImpact="You should retain containers that are actively in use, and delete ones which are no longer needed."
local check="$id - $desc" local check="$id - $desc"
starttestjson "$id" "$desc" starttestjson "$id" "$desc"
total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}') total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}')