Security benchmarks (CIS Docker) - Step-by-Step Execution

Process Flow - Security benchmarks (CIS Docker)

Start: Docker Host Setup

↓

Install Docker

↓

Run CIS Docker Benchmark Scan

↓

Analyze Scan Report

↓

Apply Recommended Fixes

↓

Re-scan to Verify Compliance

↓

Maintain Regular Scans & Updates

This flow shows how to secure Docker by running CIS benchmarks, analyzing results, fixing issues, and verifying compliance.

Execution Sample

Docker

git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json
cat cis_report.json
# Review report
# Fix issues
# Re-run scan

Run a CIS Docker benchmark scan on the Docker host setup, save the report, review it, fix issues, and re-scan to check compliance.

Process Table

Step	Command/Action	Result/Output	System State Change
1	git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json	Scan completes, JSON report saved	Report file 'cis_report.json' created with benchmark results
2	cat cis_report.json	JSON output listing passed and failed checks	User reads scan results to identify issues
3	Apply fixes (e.g., update Dockerfile, change permissions)	No direct output	Dockerfile and host configuration updated to fix issues
4	cd docker-bench-security && sudo ./docker-bench-security.sh --json-file cis_report.json	New scan report generated	Report updated reflecting fixes, fewer or no failures
5	Repeat fixes and scans as needed	Improved compliance over time	System moves towards CIS benchmark compliance

💡 Scan shows no critical failures, indicating CIS Docker benchmark compliance achieved

Status Tracker

Variable	Start	After Scan 1	After Fixes	After Scan 2	Final
Scan Report	None	JSON with failures	None (fixes applied)	JSON with fewer/no failures	Compliant report

Key Moments - 3 Insights

Why does the scan report show failures even if Docker is installed?

The scan checks many security settings beyond installation, like permissions and configurations. See execution_table step 2 where the report lists these failures.

What happens if I don't fix the issues found in the scan?

The system remains non-compliant and vulnerable. The scan will keep showing failures as in step 4 until fixes are applied (step 3).

Can I run the scan multiple times?

Yes, running scans repeatedly after fixes (steps 4 and 5) helps verify improvements and maintain security.

Visual Quiz - 3 Questions

Look at the execution table, what is created after the first scan command?

A A new Docker image

B A JSON report file named 'cis_report.json'

C A running Docker container

D A backup of the Dockerfile

💡 Hint

Refer to execution_table row 1, 'Result/Output' column

At which step does the system state change by applying fixes?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check execution_table 'System State Change' column for step 3

If you skip re-running the scan after fixes, what happens to compliance status?

A Compliance status remains unknown

B Compliance is verified automatically

C System becomes compliant immediately

D Scan report deletes itself

💡 Hint

See execution_table steps 4 and 5 about re-scanning to verify compliance

Concept Snapshot

CIS Docker benchmarks help secure Docker setups.
Run 'sudo ./docker-bench-security.sh --json-file cis_report.json' to get a report.
Review report for failures, fix issues in Dockerfile or host.
Re-run scan to verify fixes.
Repeat regularly to maintain security compliance.

Full Transcript

This visual execution shows how to use CIS Docker security benchmarks. First, you run a scan command that checks your Docker environment, saving results in a JSON report. Then, you read the report to find security issues. Next, you apply fixes like changing permissions or updating configurations. After that, you run the scan again to see if the fixes worked. This cycle repeats until your Docker setup meets the CIS security standards, helping keep your containers safe.