Skip to content
Digital Sentinel
All concepts
ContainersAssociate

Docker Bench: auditing container security, with the commands

Day 1 of working through every AWS security lab. Running Docker Bench against a live server, picking a warning, fixing it with auditd, and proving the fix.

3 min read

Day 1 of 38: complete every AWS security lab.

Today's is using Docker Bench to enhance container security. The objective is to run the Docker Bench security script against a running server, then actually fix something it complains about.

The fixing part is what makes it worth doing. Running a scanner is easy; remediating and then proving the remediation is the skill.

1. Clone the script onto the server

git clone https://github.com/docker/docker-bench-security

2. Run it and save the output

cd docker-bench-security
sudo sh docker-bench-security.sh > /tmp/bench1.out

3. Read the report

more /tmp/bench1.out

The warning I picked to fix:

[WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories
              - /var/lib/docker (Automated)

4. See what audit rules already exist

sudo auditctl -l

Always look before you change. You want to know what was there.

5. Add the rule

sudo auditctl -w /var/lib/docker -k "docker lib"

-w watches a path, -k tags matching events with a key so you can find them later in the audit log. That key is what makes the rule useful during an investigation rather than just satisfying a checkbox.

6. Confirm it took effect

sudo auditctl -l

7. Run the scan again, into a different file

sudo sh docker-bench-security.sh > /tmp/bench2.out

8. Compare

more /tmp/bench2.out

And we get a PASS. At least for that one. That's a start!

What this is actually for

Reviewing the security of your containers certainly seems like it should be standard practice. But do check in with your own company's security posture and compliance requirements, so that what you are doing lines up with what you are actually required to do.

What did we learn?

  1. Save scan output to a file. You need a before and an after.
  2. Fix one finding properly rather than skimming all of them.
  3. auditctl -w <path> -k <key> — the key is what makes the rule searchable later.
  4. Check existing rules before adding yours.
  5. Re-scan to a different file and compare. Prove the fix.
  6. Compliance and security overlap. They are not the same thing.

I'm posting the steps for these labs as I go, mostly for accountability. 38 to get through.

Should I start an accountability group? Genuinely asking.

TagsDockercontainersAWShardeningcompliance