This InSpec compliance profile implement the CIS Docker 1.13.0 Benchmark in an automated way to provide security best-practice tests around Docker daemon and containers in a production environment.
InSpec is an open-source run-time framework and rule language used to specify compliance, security, and policy requirements for testing any node in your infrastructure.
- at least InSpec version 2.3.23
- Docker 1.13+
- Debian 8
- Ubuntu 16.04
- CentOS 7
We use a yml attribute file to steer the configuration, the following options are available:
trusted_user: vagrantdefine trusted user to control Docker daemon.authorization_plugin: authz-brokerdefine authorization plugin to manage access to Docker daemon.log_driver: syslogdefine preferable way to store logs.log_opts: /syslog-address/define Docker daemon log-opts.registry_cert_path: /etc/docker/certs.ddirectory contains various Docker registry directories.registry_name: /etc/docker/certs.d/registry_hostname:portdirectory contain certificate certain Docker registry.registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crtcertificate file for a certain Docker registry certificate files.container_user: vagrantdefine user within containers.app_armor_profile: docker-defaultdefine apparmor profile for Docker containers.selinux_profile: /label\:level\:s0-s0\:c1023/define SELinux profile for Docker containers.container_capadd: nulldefine needed capabilities for containers. example:container_capadd: NET_ADMIN,SYS_ADMINmanagable_container_number: 25keep number of containers on a host to a manageable total.daemon_tlscacert : /etc/docker/ssl/ca.pemconfigure the certificate authority.daemon_tlscert: /etc/docker/ssl/server_cert.pemconfigure the server certificate.daemon_tlskey: /etc/docker/ssl/server_key.pemconfigure the server key.swarm_mode: inactiveconfigure the swarm mode.swarm_max_manager_nodes: 3configure the maximum number of swarm leaders.swarm_port: 2377configure the swarm port.benchmark_versionto execute also the old controls from previous benchmarks, e.g. set it to 1.12.0 to execute also the tests from cis-benchmark-1.12.0 (which is the default).
These settings can be overridden using an attributes file (e.g. --attrs <attributefile.yml>). See sample_attributes.yml as an example.
InSpec makes it easy to run your tests wherever you need. More options listed here: InSpec cli
# run profile locally
$ git clone https://github.com/dev-sec/cis-docker-benchmark
$ inspec exec cis-docker-benchmark
# run profile locally and directly from Github
$ inspec exec https://github.com/dev-sec/cis-docker-benchmark
# run profile on remote host via SSH
inspec exec cis-docker-benchmark -t ssh://user@hostname -i /path/to/key
# run profile on remote host via SSH with sudo
inspec exec cis-docker-benchmark -t ssh://user@hostname -i /path/to/key --sudo
# run profile on remote host via SSH with sudo and define attribute value
inspec exec cis-docker-benchmark --attrs sample_attributes.yml
# run profile direct from inspec supermarket
inspec supermarket exec dev-sec/cis-docker-benchmark -t ssh://user@hostname --key-files private_key --sudoIn order to verify individual controls, just provide the control ids to InSpec:
inspec exec cis-docker-benchmark --controls 'cis-docker-benchmark-1.4 cis-docker-benchmark-1.5'- Patrick Muench atomic111
- Dominik Richter arlimus
- Christoph Hartmann chris-rock
- Author:: Patrick Muench [email protected]
- Author:: Christoph Hartmann [email protected]
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent