GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #428 from konstruktoid/ISSUE424

Browse source 
update README, correct volume binary paths
This commit is contained in:
Thomas Sjögren 2020-04-16 15:18:38 +00:00 committed by GitHub
commit d53ac42de1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
README.md
View file

@ -1,6 +1,6 @@
# Docker Bench for Security # Docker Bench for Security
![Docker Bench for Security running](https://raw.githubusercontent.com/docker/docker-bench-security/master/benchmark_log.png "Docker Bench for Security running") ![Docker Bench for Security running](https://raw.githubusercontent.com/docker/docker-bench-security/master/benchmark_log.png)
The Docker Bench for Security is a script that checks for dozens of common The Docker Bench for Security is a script that checks for dozens of common
best-practices around deploying Docker containers in production. The tests are best-practices around deploying Docker containers in production. The tests are
@ -24,8 +24,8 @@ running our pre-built container:
docker run -it --net host --pid host --userns host --cap-add audit_control \ docker run -it --net host --pid host --userns host --cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \ -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /etc:/etc:ro \ -v /etc:/etc:ro \
-v /usr/bin/docker-containerd:/usr/bin/docker-containerd:ro \ -v /usr/bin/containerd:/usr/bin/containerd:ro \
-v /usr/bin/docker-runc:/usr/bin/docker-runc:ro \ -v /usr/bin/runc:/usr/bin/runc:ro \
-v /usr/lib/systemd:/usr/lib/systemd:ro \ -v /usr/lib/systemd:/usr/lib/systemd:ro \
-v /var/lib:/var/lib:ro \ -v /var/lib:/var/lib:ro \
-v /var/run/docker.sock:/var/run/docker.sock:ro \ -v /var/run/docker.sock:/var/run/docker.sock:ro \
@ -33,14 +33,16 @@ docker run -it --net host --pid host --userns host --cap-add audit_control \
docker/docker-bench-security docker/docker-bench-security
``` ```
Don't forget to adjust the shared volumes according to your operating system. Some examples are: Don't forget to adjust the shared volumes according to your operating system.
Some examples are:
1. `Docker Desktop` on macOS don't have `/usr/lib/systemd` or the above Docker binaries. 1. `Docker Desktop` on macOS don't have `/usr/lib/systemd` or the above Docker binaries.
```sh ```sh
docker run -it --net host --pid host --userns host --cap-add audit_control \ docker run -it --net host --pid host --userns host --cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \ -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /etc:/etc \ -v /etc:/etc \
-v usr/local/bin/ -v /usr/local/bin:/usr/local/bin:ro \
-v /var/lib:/var/lib:ro \ -v /var/lib:/var/lib:ro \
-v /var/run/docker.sock:/var/run/docker.sock:ro \ -v /var/run/docker.sock:/var/run/docker.sock:ro \
--label docker_bench_security \ --label docker_bench_security \
@ -54,8 +56,8 @@ docker run -it --net host --pid host --userns host --cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \ -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /etc:/etc:ro \ -v /etc:/etc:ro \
-v /lib/systemd/system:/lib/systemd/system:ro \ -v /lib/systemd/system:/lib/systemd/system:ro \
-v /usr/bin/docker-containerd:/usr/bin/docker-containerd:ro \ -v /usr/bin/containerd:/usr/bin/containerd:ro \
-v /usr/bin/docker-runc:/usr/bin/docker-runc:ro \ -v /usr/bin/runc:/usr/bin/runc:ro \
-v /usr/lib/systemd:/usr/lib/systemd:ro \ -v /usr/lib/systemd:/usr/lib/systemd:ro \
-v /var/lib:/var/lib:ro \ -v /var/lib:/var/lib:ro \
-v /var/run/docker.sock:/var/run/docker.sock:ro \ -v /var/run/docker.sock:/var/run/docker.sock:ro \