#!/bin/sh # ------------------------------------------------------------------------------ # Docker Bench for Security # # Docker, Inc. (c) 2015- # # Checks for dozens of common best-practices around deploying Docker containers in production. # ------------------------------------------------------------------------------ version='1.3.5' # Load dependencies . ./functions_lib.sh . ./helper_lib.sh # Setup the paths this_path=$(abspath "$0") ## Path of this file including filename myname=$(basename "${this_path}") ## file name of this script. readonly version readonly this_path readonly myname export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin/ # Check for required program(s) req_progs='awk docker grep ss stat' for p in $req_progs; do command -v "$p" >/dev/null 2>&1 || { printf "%s command not found.\n" "$p"; exit 1; } done # Ensure we can connect to docker daemon if ! docker ps -q >/dev/null 2>&1; then printf "Error connecting to docker daemon (does docker ps work?)\n" exit 1 fi usage () { cat </dev/null 2>&1; then benchcont="$c" fi done # get the image id of the docker_bench_security_image, memorize it: benchimagecont="nil" for c in $(docker images | sed '1d' | awk '{print $3}'); do if docker inspect --format '{{ .Config.Labels }}' "$c" | \ grep -e 'docker.bench.security' >/dev/null 2>&1; then benchimagecont="$c" fi done if [ -n "$include" ]; then pattern=$(echo "$include" | sed 's/,/|/g') containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont" | grep -E "$pattern") images=$(docker images | grep -E "$pattern" | sed '1d' | awk '{print $3}' | grep -v "$benchimagecont") elif [ -n "$exclude" ]; then pattern=$(echo "$exclude" | sed 's/,/|/g') containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont" | grep -Ev "$pattern") images=$(docker images | grep -Ev "$pattern" | sed '1d' | awk '{print $3}' | grep -v "$benchimagecont") else containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont") images=$(docker images -q | grep -v "$benchcont") fi if [ -z "$containers" ]; then running_containers=0 else running_containers=1 fi for test in tests/*.sh; do . ./"$test" done if [ -z "$check" ] && [ ! "$checkexclude" ]; then cis elif [ -z "$check" ] && [ "$checkexclude" ]; then checkexcluded="$(echo ",$checkexclude" | sed -e 's/^/\^/g' -e 's/,/\$|/g' -e 's/$/\$/g')" for c in $(grep -E 'check_[0-9]|check_[a-z]' functions_lib.sh | grep -vE "$checkexcluded"); do "$c" done else for i in $(echo "$check" | sed "s/,/ /g"); do if command -v "$i" 2>/dev/null 1>&2; then "$i" else echo "Check \"$i\" doesn't seem to exist." continue fi done fi printf "\n" info "Checks: $totalChecks" info "Score: $currentScore" endjson "$totalChecks" "$currentScore" "$(date +%s)" } main "$@"