Docker Bench for Security Checks

What is Docker Bench for Security?

Docker Bench for Security is like a security audit tool that checks if your Docker environment is properly configured to avoid vulnerabilities and security risks. It checks various settings and practices, comparing them against industry standards and best practices.

Docker Bench for Security Checks:

1. Docker Daemon Security Configuration

The Docker Daemon (the background service that manages Docker containers) is the heart of Docker’s functionality, so securing it is critical. Docker Bench checks the following for the Docker Daemon:

• User Namespaces: Ensures Docker is running with user namespaces enabled to isolate containers from the host system.
• Docker Daemon Configurations: Verifies if the Docker Daemon is using secure settings (e.g., restricting Docker API access, enforcing TLS for Docker Daemon communication).
• Docker Version: Checks whether Docker is running the latest secure version.
• TLS Encryption: Verifies that Docker is set up with secure communications using TLS for remote management.

2. Docker Image Security

Docker Bench for Security checks whether you’re using trusted images for your containers. Some of the checks include:

• Official Images: Ensures that you’re using official, well-maintained images from Docker Hub rather than untrusted third-party images that might contain vulnerabilities.
• Image Integrity: It checks if the images you use are being pulled from a trusted registry with proper image signing and verification.

3. Container Security

Docker Bench looks at how your containers are configured in terms of security. Some of the container security checks include:

• Privileged Containers: Checks whether any containers are running in privileged mode. Privileged mode gives the container full access to the host system, which can be a significant security risk.
• User Permissions: Verifies whether containers run as a non-root user (instead of the root user, which has high-level access to the system).
• Exposed Ports: Checks if containers unnecessarily expose ports to the outside world.
• Read-Only File System: Verifies if containers are using a read-only file system, which makes it harder for attackers to modify containers if they gain access.

4. Host System Security

Docker Bench also checks the underlying host system (the server or virtual machine running Docker) to ensure that it’s properly secured. Some of the host checks include:

• Docker Socket: Verifies if the Docker socket file (/var/run/docker.sock) has proper access controls. This file allows containers to interact with the Docker daemon, and improper access can lead to privilege escalation.
• Kernel Settings: Checks if the host’s kernel has proper security settings (like preventing certain types of attacks that could affect Docker containers).

5. Network and Runtime Configurations

Docker Bench verifies the security of Docker’s networking features and runtime configurations:

• Bridge Networks: Ensures Docker containers are not using insecure networking modes (e.g., bridge mode) unless necessary.
• Runtime Security: Checks if the Docker runtime (the environment where containers execute) is configured securely.

Installing Docker on macOS

Download Docker Desktop for macOS

1. Go to the official Docker website click Download for Mac and follow the installation instructions.
2. After the installation is complete, run Docker Desktop from your Applications folder.

Verify Docker Installation

Open Terminal and run:

docker --version

Setting Up Docker Bench for Security

Pull the Docker Bench for Security Image

Once Docker is installed, you’ll need to pull the Docker Bench for Security image from the Docker Hub.

Get Sanjjushri Varshini R’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In your terminal or command prompt, run:

docker pull docker/docker-bench-security

Run Docker Bench for Security

After the image is downloaded, you can run Docker Bench for Security as a container to begin the security audit.

On macOS or Windows, execute the following command in your terminal (ensure Docker is running):

docker run -it --net host --pid host --cap-add=NET_ADMIN --cap-add=SYS_ADMIN -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Explanation of the command:

• docker run: Starts a new container.
• -it: Runs the container in interactive mode with a terminal.
• --net host: Allows the container to share the host's network stack.
• --pid host: Allows the container to access the host's PID namespace.
• --cap-add=NET_ADMIN --cap-add=SYS_ADMIN: Adds extra capabilities to the container for network and system administration.
• -v /var/run/docker.sock:/var/run/docker.sock:ro: Mounts the Docker socket inside the container to allow the script to interact with Docker on the host system.
• docker/docker-bench-security: This is the Docker image you're running.

View the Security Report

Once the container starts, it will execute various security checks and display the results in your terminal. These results will show you potential security issues or configurations that can be improved based on Docker security best practices.

Key Points in the Output:

Sections: The output is organized into multiple sections, each focusing on a different area of Docker security (e.g., Host Configuration, Docker Daemon, Container Images, etc.).

Warnings and Notes: The tool provides three types of outputs:

• [PASS]: This means the Docker configuration is following best practices for that particular check.
• [INFO]: This provides general information or checks that are neutral and not necessarily a security issue.
• [WARN]: A warning indicates that a configuration or setting might be risky or not optimal.

Security Recommendations: It points out potential security risks, such as:

• Missing auditing configuration for Docker files.
• Unrestricted network traffic between containers on the default bridge network (can lead to vulnerabilities).
• No TLS (Transport Layer Security) for the Docker daemon, meaning data is not encrypted when transmitted, making it easier for attackers to intercept.
• No health checks for certain container images (which could lead to undetected issues in the running containers).
• Score: At the end, it gives you a score ranging from 0 to 100 (e.g., Score: 4). The score is just a rough measure of how secure your Docker setup is based on the checks done. Higher scores are better.

The Docker Bench for Security tool helps assess the security of Docker environments by identifying potential risks and offering actionable recommendations. A score of 4 out of 100 highlights several security gaps that need addressing to ensure best practices are followed. Regularly using this tool can significantly improve Docker container and host security.