diff --git a/Dockerfile b/Dockerfile index 96fbfc8..5b948bc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,10 +2,10 @@ FROM gliderlabs/alpine:3.1 RUN apk --update add docker -RUN mkdir /docker-bench +RUN mkdir /docker-bench-security -COPY . /docker-bench +COPY . /docker-bench-security -WORKDIR /docker-bench +WORKDIR /docker-bench-security -ENTRYPOINT ["/bin/sh", "docker-bench.sh"] +ENTRYPOINT ["/bin/sh", "docker-bench-security.sh"] diff --git a/README.md b/README.md index 9ff84d6..1cab20a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -# Docker Bench +# Docker Bench - Security -![Docker Security Benchmark running](/benchmark_log.png?raw=true "Docker Security Benchmark running") +![Docker Bench Security running](/benchmark_log.png?raw=true "Docker Bench Security running") The Docker Bench is a script that checks for all the automatable tests included in the [CIS Docker 1.6 Benchmark](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf). We are releasing this as a follow-up to our [Understanding Docker Security and Best Practices](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/) blog post. @@ -15,8 +15,8 @@ The easiest way to run your hosts against the CIS Docker 1.6 benchmark is by run ``` docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \ --v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label docker-bench \ -diogomonica/docker-bench +-v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label docker-bench-security \ +diogomonica/docker-bench-security ``` Docker bench requires Docker 1.6.2 or later to run, since it depends on the `--label` to exclude the current container from being inspected. If you can't upgrade to 1.6.2, I feel free to remove the `--label` flag or run the shell script locally (see below). @@ -28,18 +28,18 @@ Additionally, there was a bug in Docker 1.6.0 that would not allow mounting `-v If you wish to build and run this container yourself, you can follow the following steps: ``` -git clone https://github.com/diogomonica/docker-bench.git -cd docker-bench; docker build -t docker-bench . +git clone https://github.com/diogomonica/docker-bench-security.git +cd docker-bench-security; docker build -t docker-bench-security . docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \ -v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label security-benchmark \ -docker-bench +docker-bench-security ``` Also, this script can also be simply run from your base host by running: ``` -git clone https://github.com/diogomonica/docker-bench.git -cd docker-bench; sh docker-bench.sh +git clone https://github.com/diogomonica/docker-bench-security.git +cd docker-bench-security; sh docker-bench-security.sh ``` This script was build to be POSIX 2004 compliant, so it should be portable across any Unix platform. diff --git a/docker-bench.sh b/docker-bench-security.sh similarity index 100% rename from docker-bench.sh rename to docker-bench-security.sh