CIS Docker Benchmark v1.7.0

grep '/var/lib/docker\s' /proc/mounts 

mountpoint -- "$(docker info -f '{{ .DockerRootDir }}')" 

getent group docker 

auditctl -l | grep /usr/bin/dockerd 

-w /usr/bin/dockerd -k docker 

systemctl restart auditd 

auditctl -l | grep /run/containerd 

-a exit,always -F path=/run/containerd -F perm=war -k docker 

systemctl restart auditd

auditctl -l | grep /var/lib/docker 

-a exit,always -F path=/var/lib/docker -F perm=war -k docker 
-a exit,never -F dir=/var/lib/docker/volumes 
-a exit,never -F dir=/var/lib/docker/overlay2 

-a exit,always -F path=/var/lib/docker -F perm=war -k docker 
-a exit,never -F dir=/var/lib/docker/165536.165536/volumes 
-a exit,never -F dir=/var/lib/docker/165536.165536/overlay2 

systemctl restart auditd 

auditctl -l | grep /etc/docker 

-w /etc/docker -k docker 

systemctl restart auditd 

systemctl show -p FragmentPath docker.service 

auditctl -l | grep docker.service 

-w /usr/lib/systemd/system/docker.service -k docker 

systemctl restart auditd 

grep 'containerd.sock' /etc/containerd/config.toml 

auditctl -l | grep containerd.sock 

-w /run/containerd/containerd.sock -k docker 

systemctl restart auditd 

systemctl show -p FragmentPath docker.sock 

grep ListenStream <FragmentPath from previous step>

auditctl -l | grep docker.sock 

-w /var/run/docker.sock -k docker

systemctl restart auditd 

auditctl -l | grep /etc/default/docker 

 -w /etc/default/docker -k docker 

systemctl restart auditd 

auditctl -l | grep /etc/docker/daemon.json 

-w /etc/docker/daemon.json -k docker 

systemctl restart auditd 

auditctl -l | grep /etc/containerd/config.toml 

-w /etc/containerd/config.toml -k docker 

systemctl restart auditd 

auditctl -l | grep /etc/sysconfig/docker 

-w /etc/sysconfig/docker -k docker 

systemctl restart auditd 

auditctl -l | grep /usr/bin/containerd 

-w /usr/bin/containerd -k docker 

systemctl restart auditd 

auditctl -l | grep /usr/bin/containerd-shim 

-w /usr/bin/containerd-shim -k docker 

systemctl restart auditd 

auditctl -l | grep /usr/bin/containerd-shim-runc-v1 

-w /usr/bin/containerd-shim-runc-v1 -k docker 

systemctl restart auditd 

auditctl -l | grep /usr/bin/containerd-shim-runc-v2 

-w /usr/bin/containerd-shim-runc-v2 -k docker 

systemctl restart auditd 

auditctl -l | grep /usr/bin/runc 

-w /usr/bin/runc -k docker 

systemctl restart auditd

docker version 

ps -fe | grep 'dockerd' 

docker network ls --quiet | xargs docker network inspect --format '{{ .Name }}: {{ .Options }}' 

"icc": false 

dockerd --icc=false 

ps -ef | grep dockerd 

"log-level": "info" 

dockerd --log-level="info" 

ps -ef | grep dockerd 

dockerd --iptables=false 

docker info --format 'Insecure Registries: 
{{.RegistryConfig.InsecureRegistryCIDRs}}' 

docker info --format 'Storage Driver: {{ .Driver }}' 

dockerd --storage-driver aufs 

ps -ef | grep dockerd 

--tlsverify 
--tlscacert
--tlscert
--tlskey 

ps -ef | grep dockerd 

dockerd --default-ulimit nproc=1024:2048 --default-ulimit nofile=100:200 

docker inspect --format='{{ .State.Pid }}' $(docker ps -q) | while read -r line; do ps -h -p "$line" -o pid,user; done 

docker info --format '{{ .SecurityOptions }}' 

 touch /etc/subuid /etc/subgid 

dockerd --userns-remap=default 

ps -ef | grep dockerd 

dockerd --cgroup-parent=/foobar 

ps -ef | grep dockerd 

ps -ef | grep dockerd 

dockerd --authorization-plugin=<PLUGIN_ID>

docker info --format '{{ .LoggingDriver }}' 

ps -ef | grep dockerd 

dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx 

ps -ef | grep dockerd 

dockerd --no-new-privileges 

docker info --format '{{ .LiveRestoreEnabled }}' 

ps -ef | grep dockerd 

dockerd --live-restore 

ps -ef | grep dockerd 

dockerd --userland-proxy=false

docker info --format '{{ .SecurityOptions }}' 

dockerd --seccomp-profile </path/to/seccomp/profile>

docker version --format '{{ .Server.Experimental }}' 

systemctl show -p FragmentPath docker.service 

stat -c %U:%G /usr/lib/systemd/system/docker.service | grep -v root:root 

systemctl show -p FragmentPath docker.service 

chown root:root /usr/lib/systemd/system/docker.service 

systemctl show -p FragmentPath docker.service 

stat -c %a /usr/lib/systemd/system/docker.service 

systemctl show -p FragmentPath docker.service 

chmod 644 /usr/lib/systemd/system/docker.service 

systemctl show -p FragmentPath docker.socket 

stat -c %U:%G /usr/lib/systemd/system/docker.socket | grep -v root:root 

systemctl show -p FragmentPath docker.socket 

chown root:root /usr/lib/systemd/system/docker.socket 

systemctl show -p FragmentPath docker.socket 

stat -c %a /usr/lib/systemd/system/docker.socket 

systemctl show -p FragmentPath docker.socket 

chmod 644 /usr/lib/systemd/system/docker.socket 

stat -c %U:%G /etc/docker | grep -v root:root 

chown root:root /etc/docker 

stat -c %a /etc/docker 

chmod 755 /etc/docker 

stat -c %U:%G /etc/docker/certs.d/* | grep -v root:root 

chown root:root /etc/docker/certs.d//* 

find /etc/docker/certs.d/ -type f -exec stat -c "%a %n" {} \; 

find /etc/docker/certs.d/ -type f -exec chmod 0444 {} \; 

tat -c %U:%G <path to TLS CA certificate file> | grep -v root:root

chown root:root <path to TLS CA certificate file>

stat -c %a <path to TLS CA certificate file>

chmod 444  <path to TLS CA certificate file>

stat -c %U:%G <path to Docker server sertificate file> | grep -v root:root 

chown root:root <path to Docker server sertificate file>

stat -c %a <path to Docker server sertificate file> 

chmod 444 <path to Docker server sertificate file>

stat -c %U:%G <path to Docker server sertificate key file> | grep -v root:root 

chown root:root <path to Docker server sertificate key file>

stat -c %a <path to Docker server sertificate key file>

chmod 400 <path to Docker server sertificate key file>

stat -c %U:%G /var/run/docker.sock | grep -v root:docker 

chown root:docker /var/run/docker.sock 

stat -c %a /var/run/docker.sock 

chmod 660 /var/run/docker.sock 

stat -c %U:%G /etc/docker/daemon.json | grep -v root:root 

stat: cannot stat '/etc/docker/daemon.json':No such file or directory 

chown root:root /etc/docker/daemon.json 

stat -c %a /etc/docker/daemon.json 

stat: cannot stat '/etc/docker/daemon.json': No such file or directory 

chmod 644 /etc/docker/daemon.json 

stat -c %U:%G /etc/default/docker | grep -v root:root 

chown root:root /etc/default/docker 

stat -c %a /etc/default/docker 

chmod 644 /etc/default/docker 

stat -c %a /etc/sysconfig/docker 

chmod 644 /etc/sysconfig/docker 

stat -c %U:%G /etc/sysconfig/docker | grep -v root:root 

chown root:root /etc/sysconfig/docker 

stat -c %U:%G /run/containerd/containerd.sock | grep -v root:root 

chown root:root /run/containerd/containerd.sock 

stat -c %a /run/containerd/containerd.sock 

chmod 660 /run/containerd/containerd.sock 

docker ps --quiet | xargs --max-args=1 -I{} docker exec {} cat /proc/1/status | grep '^Uid:' | awk '{print $3}' 

USER <username or ID>

RUN useradd -d /home/username -m -s /bin/bash username USER username 

docker images 

docker history <imageName>

• Configure and use Docker Content trust. 
• View the history of each Docker image to evaluate its risk, dependent on the sensitivity of the application you wish to deploy using it. 
• Scan Docker images for vulnerabilities at regular intervals. 

docker ps --quiet 

docker exec $INSTANCE_ID rpm -qa 

docker ps --quiet 

echo $DOCKER_CONTENT_TRUST 

export DOCKER_CONTENT_TRUST=1 

docker inspect --format='{{ .Config.Healthcheck }}' <IMAGE>

docker images 

docker history <Image_ID>

docker export  | tar -tv 2>/dev/null | grep -E '^[- rwx].*(s|S).*\s[0-9]' 

RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true 

docker images 

docker history <IMAGE ID>

docker images 

docker history <IMAGE ID>

docker images 

docker history <IMAGE ID>

docker info --format '{{ .Swarm }}' 

docker swarm leave 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: AppArmorProfile={{ .AppArmorProfile }}' 

1. Verify AppArmor is installed. 
2. Create or import a AppArmor profile for Docker containers. 
3. Enable enforcement of the policy. 
4. Start your Docker container using the customized AppArmor profile.

 docker run --interactive --tty --security-opt="apparmor:PROFILENAME" ubuntu /bin/bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }} MountLabel={{ .MountLabel }} ProcessLabel={{ .ProcessLabel }}' 

• Set the SELinux State. 
• Set the SELinux Policy. 
• Create or import a SELinux policy template for Docker containers. 
• Start Docker in daemon mode with SELinux enabled. 

docker daemon --selinux-enabled 

{ 
"selinux-enabled": true 
} 

• Start your Docker container using the security options. 

docker run --interactive --tty --security-opt label=level:TopSecret centos /bin/bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}' 

docker run --cap-add={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

docker run --cap-drop={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

docker run --cap-drop=all --cap-add={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

docker service create --cap-drop=all --cap-add={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

AUDIT_WRITE 
CHOWN 
DAC_OVERRIDE 
FOWNER 
FSETID 
KILL 
MKNOD 
NET_BIND_SERVICE 
NET_RAW 
SETFCAP 
SETGID 
SETPCAP 
SETUID 
SYS_CHROOT 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}' 

docker run --interactive --tty --privileged centos /bin/bash 

/ 
/boot 
/dev 
/etc 
/lib
/lib64 
/proc 
/sys 
/usr 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' 

• Difficult to manage access policies and security compliance for SSH server 
• Difficult to manage keys and passwords across various containers 
• Difficult to manage security upgrades for SSH server 

docker ps --quiet 

docker exec <CONTAINER ID> ps -el 

docker exec --interactive --tty <CONTAINER ID> sh 

docker attach <CONTAINER ID>

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}' 

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}' 

docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: NetworkMode={{ .HostConfig.NetworkMode }}' 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Memory={{ .HostConfig.Memory }}' 

docker run -d --memory 256m centos sleep 1000 

docker inspect --format='{{ .Id }}: Memory={{.HostConfig.Memory}} KernelMemory={{.HostConfig.KernelMemory}} Swap={{.HostConfig.MemorySwap}}'  

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CpuShares={{ .HostConfig.CpuShares }}' 

docker run -d --cpu-shares 512 centos sleep 1000 

• Enable use --tmpfs for temporary file writes to /tmp 
• Use Docker shared data volumes for persistent data writes 

docker host: docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: ReadonlyRootfs={{ .HostConfig.ReadonlyRootfs }}'

docker run <Run arguments> --read-only <Container Image Name or ID> <Command> 

• Using the --tmpfs option to mount a temporary file system for non-persistent data writes. 

docker run --interactive --tty --read-only --tmpfs "/run" --tmpfs "/tmp" centos /bin/bash 

• Enabling Docker rw mounts at a container's runtime to persist container data directly on the Docker host filesystem. 

docker run --interactive --tty --read-only -v /opt/app/data:/run/app/data:rw centos /bin/bash 

• Utilizing the Docker shared-storage volume plugin for Docker data volume to persist container data. 

docker volume create -d convoy --opt o=size=20GB my-named-volume docker run --interactive --tty --read-only -v my-named-volume:/run/app/data centos /bin/bash 

• Transmitting container data outside of the Docker controlled area during the container's runtime for container data in order to ensure that it is persistent. Examples include hosted databases, network file shares and APIs. 

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}' 

docker run --detach --publish 10.2.3.4:49153:80 nginx 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: RestartPolicyName={{ .HostConfig.RestartPolicy.Name }} MaximumRetryCount={{ .HostConfig.RestartPolicy.MaximumRetryCount }}' 

docker run --detach --restart=on-failure:5 nginx 

docker run --pid=host rhel7 strace -p 1234 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: PidMode={{ .HostConfig.PidMode }}' 

docker run --interactive --tty --pid=host centos /bin/bash 

docker run --interactive --tty --ipc=container:e3a7a1a97c58 centos /bin/bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: IpcMode={{ .HostConfig.IpcMode }}' 

docker run --interactive --tty --ipc=host centos /bin/bash 

• r - read only 
• w - writable 
• m - mknod allowed 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Devices={{ .HostConfig.Devices }}' 

• CgroupPermissions - For example, rwm 
• PathInContainer - Device path within the container
• PathOnHost - Device path on the host 

docker run --interactive --tty --device=/dev/tty0:/dev/tty0:rwm -- device=/dev/temp_sda:/dev/temp_sda:rwm centos bash 

docker run --interactive --tty --device=/dev/tty0:/dev/tty0:rw -- device=/dev/temp_sda:/dev/temp_sda:r centos bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ulimits={{ .HostConfig.Ulimits }}' 

docker run -ti -d --ulimit nofile=1024:1024 centos sleep 1000 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Propagation={{range $mnt := .Mounts}} {{json $mnt.Propagation}} {{end}}' 

docker run  --volume=/hostPath:/containerPath:shared <Container Image Name or ID> <Command>

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UTSMode={{ .HostConfig.UTSMode }}' 

docker run --rm --interactive --tty --uts=host rhel7.2 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' 

ausearch -k docker | grep exec | grep privileged 

ausearch -k docker | grep exec | grep user 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CgroupParent={{ .HostConfig.CgroupParent }}' 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' 

docker run --rm -it --security-opt=no-new-privileges ubuntu bash 

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Health={{ .State.Health.Status }}' 

docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: PidsLimit={{ .HostConfig.PidsLimit }}' 

docker run -it --pids-limit 100  

docker network ls --quiet | xargs docker network inspect --format '{{ .Name }}: {{ .Options }}' 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}' 

docker run --rm -it --userns=host ubuntu bash 

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep docker.sock 

docker images --quiet | xargs docker inspect --format '{{ .Id }}: Image={{ .Config.Image }}' 

docker images 

docker images --quiet | xargs docker inspect --format '{{ .Id }}: Image={{ .Config.Image }}' 

docker info --format '{{ .Containers }}' 

docker info --format '{{ .ContainersStopped }}' 
docker info --format '{{ .ContainersRunning }}' 

docker container prune 

docker info --format '{{ .Swarm.Managers }}' 

docker node ls | grep 'Leader' 

docker node demote <ID> 

ss -lp | grep -iE ':2377|:7946' 

docker network ls --filter driver=overlay --quiet | xargs docker network inspect --format '{{.Name}} {{ .Options }}' 

docker secret ls 

docker info --format 'Swarm Autolock: {{ 
.Swarm.Cluster.Spec.EncryptionConfig.AutoLockManagers }}' 

docker swarm unlock-key 

docker swarm init --autolock 

docker swarm update --autolock 

docker swarm unlock-key --rotate 

docker info | grep "Expiry Duration" 
docker info --format 'NodeCertExpiry: {{ 
.Swarm.Cluster.Spec.CAConfig.NodeCertExpiry }}' 

docker swarm update --cert-expiry 48h 

ls -l /var/lib/docker/swarm/certificates/swarm-root-ca.crt 

docker swarm ca --rotate 

docker node inspect --format '{{ .Status.Addr }}' self 

docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3