Docker Bench for Security is a security auditing tool that automatically checks Docker hosts and containers against industry best-practices.
The tool addresses the challenge of ensuring Docker deployments comply with security standards by running automated tests based on established benchmarks. It executes dozens of checks covering configuration, runtime behavior, and system hardening across Docker hosts and containers. The tests are organized into logical groups and individual checks, allowing users to run the full suite or target specific areas of concern. Results are produced in both human-readable and JSON log formats for integration into security workflows.
Organizations running Docker in production should use this tool to identify configuration gaps and security misalignments. It suits teams that need to demonstrate compliance with security frameworks or conduct regular security audits of their Docker infrastructure. The tool can run directly on a host system or within a container with appropriate privilege escalation to access host-level configuration files and audit logs. Users should be aware that running the tool requires elevated privileges and access to system files like Docker service configurations and audit rules, which may require adjustment depending on the operating system and Docker installation method.
The project maintains alignment with external security standards through periodic updates that track benchmark versions. Development activity shows responsiveness to infrastructure changes, as evidenced by handling of platform-specific differences such as audit rule locations across distributions and Docker Desktop variations on macOS. The tool includes mechanisms for selective test execution, enabling users to run specific checks or exclude particular test groups based on their environment and compliance requirements.
