GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #111 from konstruktoid/docker_inspect_format

Browse source 
inspect output changed
This commit is contained in:
Thomas Sjögren 2015-12-22 20:34:11 +01:00
commit 5155cae50a
2 changed files with 28 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
tests/5_container_runtime.sh
View file

@ -151,7 +151,13 @@ else
/usr'
fail=0
for c in $containers; do
volumes=$(docker inspect --format '{{ .VolumesRW }}' "$c")
docker inspect --format '{{ .VolumesRW }}' "$c" 2>/dev/null 1>&2
if [ $? -eq 0 ]; then
volumes=$(docker inspect --format '{{ .VolumesRW }}' "$c")
else
volumes=$(docker inspect --format '{{ .Mounts }}' "$c")
fi
# Go over each directory in sensitive dir and see if they exist in the volumes
for v in $sensitive_dirs; do
sensitive=0
@ -264,7 +270,13 @@ else
fail=0
for c in $containers; do
memory=$(docker inspect --format '{{ .Config.Memory }}' "$c")
docker inspect --format '{{ .Config.Memory }}' "$c" 2> /dev/null 1>&2
if [ "$?" -eq 0 ]; then
memory=$(docker inspect --format '{{ .Config.Memory }}' "$c")
else
memory=$(docker inspect --format '{{ .HostConfig.Memory }}' "$c")
fi
if [ "$memory" = "0" ]; then
# If it's the first container, fail the test
@ -287,7 +299,13 @@ else
fail=0
for c in $containers; do
shares=$(docker inspect --format '{{ .Config.CpuShares }}' "$c")
docker inspect --format '{{ .Config.CpuShares }}' "$c" 2> /dev/null 1>&2
if [ "$?" -eq 0 ]; then
shares=$(docker inspect --format '{{ .Config.CpuShares }}' "$c")
else
shares=$(docker inspect --format '{{ .HostConfig.CpuShares }}' "$c")
fi
if [ "$shares" = "0" ]; then
# If it's the first container, fail the test

8
tests/6_docker_security_operations.sh
View file

@ -15,7 +15,13 @@ else
set -f; IFS=$'
'
for c in $containers; do
volumes=$(docker inspect --format '{{ .Volumes }}' "$c")
docker inspect --format '{{ .Volumes }}' "$c" 2>/dev/null 1>&2
if [ $? -eq 0 ]; then
volumes=$(docker inspect --format '{{ .Volumes }}' "$c")
else
volumes=$(docker inspect --format '{{ .Config.Volumes }}' "$c")
fi
if [ "$volumes" = "map[]" ]; then
# If it's the first container, fail the test