Docker Bench: Complete Guide to Docker Security Auditing and CIS Benchmark Assessment Using Kali Linux

Abdul Wahab Junaid

4 weeks ago

Docker Bench: Complete Guide to Docker Security Auditing and CIS Benchmark Assessment Using Kali Linux

Docker Bench for Security is an open-source shell script published by Docker, Inc. that audits a running Docker host against dozens of automated checks based on the CIS Docker Benchmark, a set of security configuration best practices published by the Center for Internet Security. Unlike Trivy, which analyzes image contents for vulnerabilities, Docker Bench inspects the host configuration, daemon configuration, and running container configuration — things like whether the Docker daemon socket is exposed without TLS, whether containers run with unnecessary privileges, whether logging is configured, and whether the host kernel has appropriate hardening enabled.

It checks areas including:

Host configuration (kernel, partitioning, auditd rules for Docker files)
Docker daemon configuration (/etc/docker/daemon.json, socket permissions, ICC, live-restore)
Docker daemon configuration files (permissions/ownership of Docker files and directories)
Container images and build files (USER instruction, trusted base images, health checks)
Container runtime (privileged mode, capabilities, --net=host, PID/IPC namespace sharing, resource limits)
Docker security operations (image sprawl, container sprawl)
Docker Swarm configuration (if applicable)

Installation

Method 1 – Run directly via Docker container (simplest, no install needed):

docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
  -v /etc:/etc:ro \
  -v /usr/bin/containerd:/usr/bin/containerd:ro \
  -v /usr/bin/runc:/usr/bin/runc:ro \
  -v /usr/lib/systemd:/usr/lib/systemd:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --label docker_bench_security \
  docker/docker-bench-security

Method 2 – Clone and run natively (needed for host-level auditd checks):

sudo apt-get update
sudo apt-get install git -y
git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
sudo ./docker-bench-security.sh

Method 3 – Kali package (if available in repos):

sudo apt-get install docker-bench-security -y

Verify installation (git method):

cd docker-bench-security
./docker-bench-security.sh -v

Expected output:

Docker Bench for Security v1.6.0

Syntax

./docker-bench-security.sh [OPTIONS]

Command-Line Options

Option	Description
`-b`	Do not print colors
`-h`	Print usage help
`-c CHECK`	Run only specific check(s), comma-separated (e.g. `-c container_images`)
`-e CHECK`	Exclude specific check(s) from the run
`-l FILE`	Log output to a specified file
`-i INCLUDE`	Include only specific check IDs (e.g. `-i 4.1,4.5`)
`-x EXCLUDE`	Exclude specific check IDs
`-n LIMIT`	Limit output to N lines per section
`-p PRINT`	Print the results in a given format
`-u USERS`	Specify list of sudo users to check
`-j`	Output results as JSON
`-v`	Print version and exit

Common check group names usable with -c/-e:

check_host_configuration
check_docker_daemon_configuration
check_docker_daemon_configuration_files
check_container_images
check_container_runtime
check_docker_security_operations
check_docker_swarm_configuration

Basic Usage

sudo ./docker-bench-security.sh

Expected output (truncated):

# ------------------------------------------------------------------------------
# Docker Bench for Security v1.6.0
#
# Docker, Inc. (c) 2025 -
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker Community Edition Benchmark v1.6.0.
# ------------------------------------------------------------------------------

Initializing Sun Jul 19 10:31:02 +05 2026

[INFO] 1 - Host Configuration
[WARN] 1.1  - Ensure a separate partition for containers has been created
[PASS] 1.2  - Ensure only trusted users are allowed to control Docker daemon
[WARN] 1.3  - Ensure auditing is configured for the Docker daemon
[WARN] 1.4  - Ensure auditing is configured for Docker files and directories - /run/containerd

[INFO] 2 - Docker daemon configuration
[PASS] 2.1  - Ensure network traffic is restricted between containers on the default bridge
[WARN] 2.2  - Ensure the logging level is set to 'info'
[PASS] 2.5  - Ensure aufs storage driver is not used

[INFO] 4 - Container Images and Build File
[WARN] 4.1  - Ensure a user for the container has been created
[PASS] 4.5  - Ensure Content trust for Docker is Enabled

[INFO] 5 - Container Runtime
[WARN] 5.1  - Ensure AppArmor Profile is Enabled
[PASS] 5.2  - Ensure SELinux security options are set, if applicable
[WARN] 5.4  - Ensure privileged containers are not used
[WARN] 5.7  - Ensure privileged ports are not mapped within containers

[INFO] Checks: 115
[INFO] Score: 42

Practical Examples with Output

Example 1 – Run only the container runtime checks:

sudo ./docker-bench-security.sh -c check_container_runtime

[INFO] 5 - Container Runtime
[WARN] 5.1  - Ensure AppArmor Profile is Enabled
[WARN] 5.4  - Ensure privileged containers are not used
     * Container running in Privileged mode: web_debug
[PASS] 5.9  - Ensure the host's network namespace is not shared
[WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges

Example 2 – Exclude Swarm checks on a non-Swarm host:

sudo ./docker-bench-security.sh -e check_docker_swarm_configuration

[INFO] 7 - Docker Swarm Configuration
[INFO]   * Skipped: Docker Swarm checks excluded

Example 3 – Log full results to a file:

sudo ./docker-bench-security.sh -l /var/log/docker-bench.log
cat /var/log/docker-bench.log | tail -5

[INFO] Checks: 115
[INFO] Score: 47
[INFO] Total Warnings: 34
[INFO] Total Passes: 55
[INFO] Total Info: 26

Example 4 – Output as JSON for programmatic parsing:

sudo ./docker-bench-security.sh -j

{
  "start": "2026-07-19T10:41:07Z",
  "end": "2026-07-19T10:41:19Z",
  "checks": [
    {"id": "1.1", "desc": "Ensure a separate partition for containers has been created", "result": "WARN"},
    {"id": "4.1", "desc": "Ensure a user for the container has been created", "result": "WARN"}
  ],
  "score": 42
}

Example 5 – Run only specific check IDs:

sudo ./docker-bench-security.sh -i 5.4,5.7,5.9

[WARN] 5.4  - Ensure privileged containers are not used
[WARN] 5.7  - Ensure privileged ports are not mapped within containers
[PASS] 5.9  - Ensure the host's network namespace is not shared

Example 6 – Run via Docker container against the host daemon:

docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -v /etc:/etc:ro -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --label docker_bench_security docker/docker-bench-security

[INFO] 3 - Docker daemon configuration files
[PASS] 3.1  - Ensure that the docker.service file ownership is set to root:root
[PASS] 3.2  - Ensure that docker.service file permissions are appropriately set
[WARN] 3.19 - Ensure that the Docker socket file ownership is set to root:docker

Example 7 – Detect a container running as root:

sudo ./docker-bench-security.sh -c check_container_images

[WARN] 4.1  - Ensure a user for the container has been created
     * Container running as root: nginx_prod (nginx:latest)

Example 8 – Combine host and daemon checks only:

sudo ./docker-bench-security.sh -c check_host_configuration,check_docker_daemon_configuration

[INFO] 1 - Host Configuration
[WARN] 1.1  - Ensure a separate partition for containers has been created
[INFO] 2 - Docker daemon configuration
[PASS] 2.6  - Ensure TLS authentication for Docker daemon is configured

Common Use Cases

Auditing a fresh Docker host before it goes into production.
Periodic (weekly/monthly) compliance sweeps of production Docker hosts.
Pre-flight validation on Kali or any pentest jump box being used as a Docker host to avoid self-inflicted misconfigurations.
Feeding results into a SIEM or GRC tool via the -j JSON output for tracking compliance drift over time.
Validating remediation after fixing a previously flagged item.

Automation with Bash

#!/usr/bin/env bash
# docker-bench-weekly.sh - Weekly Docker host audit with alerting
set -euo pipefail

REPO_DIR="/opt/docker-bench-security"
REPORT="/var/log/docker-bench-$(date +%F).log"
THRESHOLD=50   # minimum acceptable score

cd "$REPO_DIR"
sudo ./docker-bench-security.sh -l "$REPORT" -j > "${REPORT}.json"

SCORE=$(grep -oP '(?<=Score: )\d+' "$REPORT" | tail -1)

echo "[*] Docker Bench score: $SCORE"

if [ "$SCORE" -lt "$THRESHOLD" ]; then
  echo "[!] Score below threshold ($THRESHOLD). Sending alert..."
  mail -s "Docker Bench Alert: score $SCORE" secteam@example.com < "$REPORT"
fi

Schedule with cron:

crontab -e
# Run every Monday at 06:00
0 6 * * 1 /opt/docker-bench-security/docker-bench-weekly.sh

Tips and Best Practices

Run Docker Bench natively with sudo (not only inside a container) whenever possible — host-level auditd checks require access to the real filesystem and cannot be fully evaluated from inside a container.
Treat WARN as “review”, not automatically “fix” — some warnings (e.g. Swarm checks on a non-Swarm single-host setup) are expected and can be excluded with -e.
Re-run after every Docker daemon upgrade; daemon.json defaults sometimes change between versions.
Combine with Trivy: Docker Bench secures the host/daemon/runtime, Trivy secures the image contents — neither replaces the other.
Bake remediated daemon.json settings (e.g. "icc": false, "live-restore": true, "userland-proxy": false) into your host provisioning (Ansible/Terraform) so the audit passes by default on every new host.
Avoid running unnecessary containers in --privileged mode; this is consistently one of the highest-impact findings.

Troubleshooting

Problem	Cause	Fix
Script exits immediately with “This script must be run as root”	Not run with sudo	Prefix with `sudo`
Host configuration checks all show `INFO`/skip	Running inside a container without host mounts	Use the native git-clone method, not the container method, for host-level checks
`command not found: docker`	Docker not installed or not in PATH	Install Docker Engine first
Audit rules checks always WARN	`auditd` not installed/configured	`sudo apt install auditd` and add rules per CIS recommendations
JSON output missing fields	Older Docker Bench version	Update to latest via `git pull` in the cloned repo

References

GitHub repository: https://github.com/docker/docker-bench-security
CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker
Docker security documentation: https://docs.docker.com/engine/security/