GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Rename to docker-bench-security

Browse source
This commit is contained in:
Diogo Monica 2015-05-27 15:08:25 -07:00
parent 4194b1e65c
commit a4cd4aa511
3 changed files with 13 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Dockerfile
View file

@ -2,10 +2,10 @@ FROM gliderlabs/alpine:3.1
RUN apk --update add docker RUN apk --update add docker
RUN mkdir /docker-bench RUN mkdir /docker-bench-security
COPY . /docker-bench COPY . /docker-bench-security
WORKDIR /docker-bench WORKDIR /docker-bench-security
ENTRYPOINT ["/bin/sh", "docker-bench.sh"] ENTRYPOINT ["/bin/sh", "docker-bench-security.sh"]

18
README.md
View file

@ -1,6 +1,6 @@
# Docker Bench # Docker Bench - Security
![Docker Security Benchmark running](/benchmark_log.png?raw=true "Docker Security Benchmark running") ![Docker Bench Security running](/benchmark_log.png?raw=true "Docker Bench Security running")
The Docker Bench is a script that checks for all the automatable tests included in the [CIS Docker 1.6 Benchmark](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf). We are releasing this as a follow-up to our [Understanding Docker Security and Best Practices](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/) blog post. The Docker Bench is a script that checks for all the automatable tests included in the [CIS Docker 1.6 Benchmark](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf). We are releasing this as a follow-up to our [Understanding Docker Security and Best Practices](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/) blog post.
@ -15,8 +15,8 @@ The easiest way to run your hosts against the CIS Docker 1.6 benchmark is by run
``` ```
docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \ docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label docker-bench \ -v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label docker-bench-security \
diogomonica/docker-bench diogomonica/docker-bench-security
``` ```
Docker bench requires Docker 1.6.2 or later to run, since it depends on the `--label` to exclude the current container from being inspected. If you can't upgrade to 1.6.2, I feel free to remove the `--label` flag or run the shell script locally (see below). Docker bench requires Docker 1.6.2 or later to run, since it depends on the `--label` to exclude the current container from being inspected. If you can't upgrade to 1.6.2, I feel free to remove the `--label` flag or run the shell script locally (see below).
@ -28,18 +28,18 @@ Additionally, there was a bug in Docker 1.6.0 that would not allow mounting `-v
If you wish to build and run this container yourself, you can follow the following steps: If you wish to build and run this container yourself, you can follow the following steps:
``` ```
git clone https://github.com/diogomonica/docker-bench.git git clone https://github.com/diogomonica/docker-bench-security.git
cd docker-bench; docker build -t docker-bench . cd docker-bench-security; docker build -t docker-bench-security .
docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \ docker run -it --net host --pid host -v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label security-benchmark \ -v /usr/lib/systemd:/usr/lib/systemd -v /etc:/etc --label security-benchmark \
docker-bench docker-bench-security
``` ```
Also, this script can also be simply run from your base host by running: Also, this script can also be simply run from your base host by running:
``` ```
git clone https://github.com/diogomonica/docker-bench.git git clone https://github.com/diogomonica/docker-bench-security.git
cd docker-bench; sh docker-bench.sh cd docker-bench-security; sh docker-bench-security.sh
``` ```
This script was build to be POSIX 2004 compliant, so it should be portable across any Unix platform. This script was build to be POSIX 2004 compliant, so it should be portable across any Unix platform.

0
docker-bench.sh → docker-bench-security.sh
View file