# Performing Docker Bench Security Assessment

> Perform performing docker bench security assessment assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/performing-docker-bench-security-assessment` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/performing-docker-bench-security-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/performing-docker-bench-security-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/performing-docker-bench-security-assessment

---


## TL;DR

- **目的**：Run Docker Bench for Security, the open-source CIS Docker Benchmark audit script, to check host configuration, Docker daemon settings, conta…
- **适用**：云/K8s/容器/配置审计
- **输入**：Docker 守护进程（socket/TCP）+ 基准测试项
- **输出**：配置审计报告 + 修复建议
- **红线**：**仅限授权范围内**；破坏性 POC 先用只读变体；全 RCE 前明确批准
- **关联**：上游：003-src-session-start → 下游：043-hunt-nosqli, 027-hunt-cors, 028-hunt-csrf

# Performing Docker Bench Security Assessment

## Overview

Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host configuration, Docker daemon settings, container images, runtime configurations, and security operations to generate a compliance report with pass/fail/warn results.


## When to Use

- When conducting security assessments that involve performing docker bench security assessment
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Docker Engine installed and running
- Root or sudo access on Docker host
- Docker Bench Security script or container image

## Workflow

### Step 1: Run Docker Bench Security

```bash
# Run as a container (recommended)
docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
  -v /etc:/etc:ro \
  -v /usr/bin/containerd:/usr/bin/containerd:ro \
  -v /usr/bin/runc:/usr/bin/runc:ro \
  -v /usr/lib/systemd:/usr/lib/systemd:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --label docker_bench_security \
  docker/docker-bench-security

# Run with JSON output
docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -v /etc:/etc:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  docker/docker-bench-security -l /dev/stdout 2>/dev/null | tee docker-bench-results.json

# Run specific sections only
docker run --rm --net host --pid host --userns host \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  docker/docker-bench-security -c container_images,container_runtime
```

### Step 2: Interpret Results

```
[INFO] 1 - Host Configuration
[PASS] 1.1.1 - Ensure a separate partition for containers has been created
[WARN] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon
[PASS] 1.1.3 - Ensure auditing is configured for the Docker daemon

[INFO] 2 - Docker daemon configuration
[FAIL] 2.1 - Run the Docker daemon as a non-root user
[PASS] 2.2 - Ensure network traffic is restricted between containers on the default bridge
```

### Step 3: Remediate Common Failures

```bash
# Fix 2.2: Restrict inter-container communication
echo '{"icc": false}' | sudo tee /etc/docker/daemon.json

# Fix 2.17: Restrict containers from acquiring new privileges
echo '{"no-new-privileges": true}' | sudo tee -a /etc/docker/daemon.json

# Fix 5.3: Restrict Linux kernel capabilities
# Use --cap-drop ALL in docker run commands

# Fix 5.12: Mount container's root filesystem as read only
# Use --read-only flag in docker run commands

# Restart Docker daemon after configuration changes
sudo systemctl restart docker
```

### Step 4: Automate Scheduled Assessments

```yaml
# docker-compose for scheduled assessment
version: '3.8'
services:
  bench-security:
    image: docker/docker-bench-security
    network_mode: host
    pid: host
    userns_mode: host
    cap_add:
      - audit_control
    volumes:
      - /etc:/etc:ro
      - /var/lib:/var/lib:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./results:/results
    command: -l /results/bench-$(date +%Y%m%d).log
    deploy:
      restart_policy:
        condition: none
```

## Validation Commands

```bash
# Verify remediation
docker run --rm docker/docker-bench-security 2>&1 | grep -E "(PASS|FAIL|WARN)" | sort | uniq -c

# Count results by type
docker run --rm docker/docker-bench-security 2>&1 | grep -c "PASS"
docker run --rm docker/docker-bench-security 2>&1 | grep -c "FAIL"
docker run --rm docker/docker-bench-security 2>&1 | grep -c "WARN"
```

## References

- [Docker Bench Security](https://github.com/docker/docker-bench-security)
- [CIS Docker Benchmark](https://www.cisecurity.org/benchmark/docker)
- [Docker Security Best Practices](https://docs.docker.com/engine/security/)

## Validation Criteria

A successful discovery of this vulnerability class must demonstrate:

- [ ] POC reproducible against fresh target instance (timestamp documented)
- [ ] Impact scope quantified (data leaked / privilege gained / RCE achieved)
- [ ] CVSS or business risk score assigned
- [ ] Authorization scope documented (B SRC vs target, A 项目 vs 全量)
- [ ] No destructive side effects (if RCE, sandboxed proof preferred)
- [ ] Affected endpoint clearly identified with full URL/request

If any of these cannot be demonstrated, treat the finding as inconclusive and run `111-fp-check` for cross-verification.

## Output Format

```json
{
  "vulnerability_type": "<class>",
  "endpoint": "<URL with vulnerable parameter>",
  "poc": "<minimal reproducible payload>",
  "impact": "<data disclosed / privilege / RCE / bypass>",
  "cvss_score": "<0.0-10.0>",
  "remediation": "<concise fix recommendation>"
}
```

Save findings to `share/intel/findings/<target>-<timestamp>.md` and follow the report template selected at session start.
## Tools & Systems

- **Burp Suite Pro / Community** — Intercepting proxy, scanner, and Repeater for manual testing
- **OWASP ZAP** — Open-source alternative to Burp with active scanner
- **sqlmap** — Automated SQL injection detection (for hunt-sqli)
- **Nuclei** — Template-based vulnerability scanner
- **ffuf** — Fast web fuzzer for endpoint discovery
- **curl / wget** — Manual HTTP request crafting
- **httpx** — HTTP probing and fingerprinting

Run all tools with `-rate-limit 20` to avoid OPSEC issues. For deeper investigation, prefer manual testing with Burp over automated scanners (lower false-positive rate).