Security benchmarks (CIS Docker) - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the CIS Docker Benchmark?

The CIS Docker Benchmark provides a set of best practices and security guidelines to help secure Docker containers and the Docker host environment.

intermediate

Name one key recommendation from the CIS Docker Benchmark related to Docker daemon configuration.

One key recommendation is to enable Docker Content Trust to ensure image authenticity and integrity during pull and push operations.

beginner

Why should you avoid running containers with the root user according to CIS Docker Benchmark?

Running containers as root increases the risk of privilege escalation and potential host compromise. The benchmark recommends using non-root users inside containers.

intermediate

What is the recommended action regarding Docker socket exposure in the CIS Docker Benchmark?

The benchmark advises not to expose the Docker socket (/var/run/docker.sock) to containers as it grants full control over the Docker daemon and host.

intermediate

How does the CIS Docker Benchmark suggest managing container resource limits?

It recommends setting resource limits like CPU and memory to prevent containers from exhausting host resources and affecting other containers.

What does the CIS Docker Benchmark primarily focus on?

A Increasing Docker build speed

B Optimizing Docker network performance

C Adding new Docker features

D Improving Docker container security

The CIS Docker Benchmark provides security best practices to protect Docker containers and hosts.

According to CIS Docker Benchmark, which user should containers avoid running as?

A root

B nobody

C docker

D admin

Running containers as root can lead to security risks; non-root users are recommended.

Why should the Docker socket not be exposed to containers?

A It slows down container startup

B It grants full control over the Docker daemon and host

C It causes network conflicts

D It increases image size

Exposing the Docker socket allows containers to control the Docker daemon, risking host security.

What is Docker Content Trust used for according to CIS Docker Benchmark?

A Verifying image authenticity and integrity

B Monitoring container performance

C Managing container logs

D Encrypting container data

Docker Content Trust ensures images are signed and verified before use.

What resource limits does CIS Docker Benchmark recommend setting for containers?

A Network bandwidth only

B Disk space only

C CPU and memory

D No limits are recommended

Setting CPU and memory limits prevents containers from overusing host resources.

Explain the importance of running Docker containers as non-root users according to the CIS Docker Benchmark.

Think about how root access inside containers can affect the host system.

Describe why exposing the Docker socket to containers is discouraged in the CIS Docker Benchmark.

Consider what control the Docker socket gives to a container.

Practice

1. What is the main purpose of the CIS Docker Security Benchmark?

easy

A. To provide guidelines for securing Docker containers

B. To speed up Docker container startup time

C. To increase Docker image size for better performance

D. To automate Docker container deployment

Solution

1. Step 1: Understand CIS Docker Benchmark purpose

   The CIS Docker Security Benchmark is designed to help users secure Docker containers by providing best practice guidelines.

2. Step 2: Compare options with purpose

   Options B, C, and D relate to performance or automation, not security guidelines.

3. Final Answer:

   To provide guidelines for securing Docker containers -> Option A

4. Quick Check:

   Security guidelines = A [OK]

Hint: CIS benchmarks focus on security rules and best practices [OK]

Common Mistakes:

• Confusing security with performance improvements
• Thinking CIS automates deployment
• Assuming CIS increases image size

2. Which command runs the Docker Bench Security script to check your Docker host against CIS benchmarks?

easy

A. docker bench run security

B. docker run --rm -it docker/docker-bench-security

C. docker security scan bench

D. docker run bench-security

Solution

1. Step 1: Recall the official Docker Bench Security command

   The correct command is to run the official Docker image with docker run --rm -it docker/docker-bench-security.

2. Step 2: Check other options for syntax errors or invalid commands

   Options B, C, and D are not valid Docker commands or do not match the official usage.

3. Final Answer:

   docker run --rm -it docker/docker-bench-security -> Option B

4. Quick Check:

   Official Docker Bench command = A [OK]

Hint: Use official Docker image with docker run --rm -it [OK]

Common Mistakes:

• Using incorrect or incomplete docker run syntax
• Assuming 'docker bench' is a built-in command
• Mixing up command order or flags

3. After running Docker Bench Security, you see this output line:
[WARN] 4.1 - Ensure that containers are not running in privileged mode
What does this warning mean?

medium

A. Containers are using too much CPU

B. Containers are missing network access

C. Containers are running with extra permissions that can be risky

D. Containers are not logging output

Solution

1. Step 1: Understand privileged mode in Docker

   Privileged mode gives containers extended permissions on the host, which can be a security risk.

2. Step 2: Interpret the warning message

   The warning indicates containers are running with these risky extra permissions.

3. Final Answer:

   Containers are running with extra permissions that can be risky -> Option C

4. Quick Check:

   Privileged mode risk = C [OK]

Hint: Privileged mode means extra risky permissions [OK]

Common Mistakes:

• Confusing privileged mode with resource usage
• Thinking it relates to network or logging
• Ignoring security implications of privileged mode

4. You ran Docker Bench Security and got this error:
ERROR: 5.1 - Ensure Docker daemon is configured to use user namespaces: Not configured
How can you fix this issue?

medium

A. Restart Docker containers without changes

B. Remove all Docker images and rebuild

C. Increase Docker daemon CPU limits

D. Enable user namespaces in the Docker daemon configuration file

Solution

1. Step 1: Understand user namespaces in Docker

   User namespaces isolate container users from host users, improving security.

2. Step 2: Fix the error by enabling user namespaces

   This requires editing the Docker daemon config (e.g., /etc/docker/daemon.json) to enable user namespaces and restarting Docker.

3. Final Answer:

   Enable user namespaces in the Docker daemon configuration file -> Option D

4. Quick Check:

   User namespaces fix = B [OK]

Hint: Enable user namespaces in daemon config to fix error [OK]

Common Mistakes:

• Restarting containers without config changes
• Changing CPU limits unrelated to namespaces
• Deleting images instead of fixing config

5. You want to improve your Docker host security by applying CIS Docker Benchmark recommendations. Which combination of actions is best?

hard

A. Run Docker Bench Security regularly, fix warnings, and restrict container privileges

B. Only update Docker to the latest version and ignore warnings

C. Disable Docker logging to improve performance and skip scans

D. Run containers as root for easier management and skip security checks

Solution

1. Step 1: Identify best practices from CIS Docker Benchmark

   Regular scanning, fixing warnings, and limiting container privileges are key security steps.

2. Step 2: Evaluate other options for security risks

   Options A, B, and C ignore warnings or increase risks by disabling logs or running as root.

3. Final Answer:

   Run Docker Bench Security regularly, fix warnings, and restrict container privileges -> Option A

4. Quick Check:

   Regular scans + fixes + least privilege = D [OK]

Hint: Scan often, fix issues, and limit privileges for best security [OK]

Common Mistakes:

• Ignoring warnings thinking updates are enough
• Disabling logs reduces visibility and security
• Running containers as root increases risk