Security benchmarks (CIS Docker) - Step-by-Step Execution

Process Flow - Security benchmarks (CIS Docker)

Start: Docker Host Setup

↓

Install Docker

↓

Run CIS Docker Benchmark Scan

↓

Analyze Scan Report

↓

Apply Recommended Fixes

↓

Re-scan to Verify Compliance

↓

Maintain Regular Scans & Updates

This flow shows how to secure Docker by running CIS benchmarks, analyzing results, fixing issues, and verifying compliance.

Execution Sample

Docker

git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json
cat cis_report.json
# Review report
# Fix issues
# Re-run scan

Run a CIS Docker benchmark scan on the Docker host setup, save the report, review it, fix issues, and re-scan to check compliance.

Process Table

Step	Command/Action	Result/Output	System State Change
1	git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json	Scan completes, JSON report saved	Report file 'cis_report.json' created with benchmark results
2	cat cis_report.json	JSON output listing passed and failed checks	User reads scan results to identify issues
3	Apply fixes (e.g., update Dockerfile, change permissions)	No direct output	Dockerfile and host configuration updated to fix issues
4	cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json	New scan report generated	Report updated reflecting fixes, fewer or no failures
5	Repeat fixes and scans as needed	Improved compliance over time	System moves towards CIS benchmark compliance

💡 Scan shows no critical failures, indicating CIS Docker benchmark compliance achieved

Status Tracker

Variable	Start	After Scan 1	After Fixes	After Scan 2	Final
Scan Report	None	JSON with failures	None (fixes applied)	JSON with fewer/no failures	Compliant report

Key Moments - 3 Insights

Why does the scan report show failures even if Docker is installed?

The scan checks many security settings beyond installation, like permissions and configurations. See execution_table step 2 where the report lists these failures.

What happens if I don't fix the issues found in the scan?

The system remains non-compliant and vulnerable. The scan will keep showing failures as in step 4 until fixes are applied (step 3).

Can I run the scan multiple times?

Yes, running scans repeatedly after fixes (steps 4 and 5) helps verify improvements and maintain security.

Visual Quiz - 3 Questions

Look at the execution table, what is created after the first scan command?

A A new Docker image

B A JSON report file named 'cis_report.json'

C A running Docker container

D A backup of the Dockerfile

💡 Hint

Refer to execution_table row 1, 'Result/Output' column

At which step does the system state change by applying fixes?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check execution_table 'System State Change' column for step 3

If you skip re-running the scan after fixes, what happens to compliance status?

A Compliance status remains unknown

B Compliance is verified automatically

C System becomes compliant immediately

D Scan report deletes itself

💡 Hint

See execution_table steps 4 and 5 about re-scanning to verify compliance

Concept Snapshot

CIS Docker benchmarks help secure Docker setups.
Run 'sudo ./docker-bench-security.sh --json-file cis_report.json' to get a report.
Review report for failures, fix issues in Dockerfile or host.
Re-run scan to verify fixes.
Repeat regularly to maintain security compliance.

Full Transcript

This visual execution shows how to use CIS Docker security benchmarks. First, you run a scan command that checks your Docker environment, saving results in a JSON report. Then, you read the report to find security issues. Next, you apply fixes like changing permissions or updating configurations. After that, you run the scan again to see if the fixes worked. This cycle repeats until your Docker setup meets the CIS security standards, helping keep your containers safe.

Practice

1. What is the main purpose of the CIS Docker Security Benchmark?

easy

A. To provide guidelines for securing Docker containers

B. To speed up Docker container startup time

C. To increase Docker image size for better performance

D. To automate Docker container deployment

Solution

1. Step 1: Understand CIS Docker Benchmark purpose

   The CIS Docker Security Benchmark is designed to help users secure Docker containers by providing best practice guidelines.

2. Step 2: Compare options with purpose

   Options B, C, and D relate to performance or automation, not security guidelines.

3. Final Answer:

   To provide guidelines for securing Docker containers -> Option A

4. Quick Check:

   Security guidelines = A [OK]

Hint: CIS benchmarks focus on security rules and best practices [OK]

Common Mistakes:

• Confusing security with performance improvements
• Thinking CIS automates deployment
• Assuming CIS increases image size

2. Which command runs the Docker Bench Security script to check your Docker host against CIS benchmarks?

easy

A. docker bench run security

B. docker run --rm -it docker/docker-bench-security

C. docker security scan bench

D. docker run bench-security

Solution

1. Step 1: Recall the official Docker Bench Security command

   The correct command is to run the official Docker image with docker run --rm -it docker/docker-bench-security.

2. Step 2: Check other options for syntax errors or invalid commands

   Options B, C, and D are not valid Docker commands or do not match the official usage.

3. Final Answer:

   docker run --rm -it docker/docker-bench-security -> Option B

4. Quick Check:

   Official Docker Bench command = A [OK]

Hint: Use official Docker image with docker run --rm -it [OK]

Common Mistakes:

• Using incorrect or incomplete docker run syntax
• Assuming 'docker bench' is a built-in command
• Mixing up command order or flags

3. After running Docker Bench Security, you see this output line:
[WARN] 4.1 - Ensure that containers are not running in privileged mode
What does this warning mean?

medium

A. Containers are using too much CPU

B. Containers are missing network access

C. Containers are running with extra permissions that can be risky

D. Containers are not logging output

Solution

1. Step 1: Understand privileged mode in Docker

   Privileged mode gives containers extended permissions on the host, which can be a security risk.

2. Step 2: Interpret the warning message

   The warning indicates containers are running with these risky extra permissions.

3. Final Answer:

   Containers are running with extra permissions that can be risky -> Option C

4. Quick Check:

   Privileged mode risk = C [OK]

Hint: Privileged mode means extra risky permissions [OK]

Common Mistakes:

• Confusing privileged mode with resource usage
• Thinking it relates to network or logging
• Ignoring security implications of privileged mode

4. You ran Docker Bench Security and got this error:
ERROR: 5.1 - Ensure Docker daemon is configured to use user namespaces: Not configured
How can you fix this issue?

medium

A. Restart Docker containers without changes

B. Remove all Docker images and rebuild

C. Increase Docker daemon CPU limits

D. Enable user namespaces in the Docker daemon configuration file

Solution

1. Step 1: Understand user namespaces in Docker

   User namespaces isolate container users from host users, improving security.

2. Step 2: Fix the error by enabling user namespaces

   This requires editing the Docker daemon config (e.g., /etc/docker/daemon.json) to enable user namespaces and restarting Docker.

3. Final Answer:

   Enable user namespaces in the Docker daemon configuration file -> Option D

4. Quick Check:

   User namespaces fix = B [OK]

Hint: Enable user namespaces in daemon config to fix error [OK]

Common Mistakes:

• Restarting containers without config changes
• Changing CPU limits unrelated to namespaces
• Deleting images instead of fixing config

5. You want to improve your Docker host security by applying CIS Docker Benchmark recommendations. Which combination of actions is best?

hard

A. Run Docker Bench Security regularly, fix warnings, and restrict container privileges

B. Only update Docker to the latest version and ignore warnings

C. Disable Docker logging to improve performance and skip scans

D. Run containers as root for easier management and skip security checks

Solution

1. Step 1: Identify best practices from CIS Docker Benchmark

   Regular scanning, fixing warnings, and limiting container privileges are key security steps.

2. Step 2: Evaluate other options for security risks

   Options A, B, and C ignore warnings or increase risks by disabling logs or running as root.

3. Final Answer:

   Run Docker Bench Security regularly, fix warnings, and restrict container privileges -> Option A

4. Quick Check:

   Regular scans + fixes + least privilege = D [OK]

Hint: Scan often, fix issues, and limit privileges for best security [OK]

Common Mistakes:

• Ignoring warnings thinking updates are enough
• Disabling logs reduces visibility and security
• Running containers as root increases risk