To audit a Linux Docker host, clone Docker’s official Docker Bench for Security repository, run sudo sh docker-bench-security.sh, and preserve both the text and JSON logs. The script checks Docker configuration against the CIS Docker Benchmark v1.6.0. Treat each PASS, WARN, or FAIL as a configuration finding to verify and remediate—not as a vulnerability-scan score.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
What Docker Bench for Security audits
Docker Bench for Security is Docker’s open-source shell script for checking common production-deployment practices. Its automated tests are based on the CIS Docker Benchmark v1.6.0, a community-consensus set of secure-configuration guidelines for Docker. The benchmark addresses three broad areas: the host operating system, the Docker daemon, and the container runtime.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallYou can obtain the official source from the Docker Bench for Security repository. The script is an assessment tool. It does not replace operating-system patch management, vulnerability scanning, image analysis, secrets management, runtime detection, logging, or incident response. A clean report means only that the tested conditions matched the benchmark rules at the time of the scan.
Prepare the host before scanning
Use a supported Docker installation
Docker Bench requires Docker 1.13.0 or later. Run the audit on the Linux host whose configuration you want to assess, rather than assuming that a scan from a different machine represents the same system. Record the Docker Engine version and Linux distribution before the first run so later reports can be compared accurately.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Obtain root access deliberately
Several checks inspect host files, daemon settings, audit configuration, and runtime state. The normal host-script method therefore uses sudo. Confirm that your organization permits the account to run the script as root and that the scan will not violate change-control or evidence-handling rules.
Install optional evidence tooling when available
jq is optional but recommended. It makes the JSON log easier to inspect and process in compliance pipelines. If the distribution does not provide auditctl, Docker Bench checks /etc/audit/audit.rules instead; the absence of the command is not, by itself, a reason to abandon the assessment.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Define what will be recorded
Before running the scan, decide where the logs will be stored and who owns remediation. Keep the following metadata with every result:
- Docker Engine version and host distribution.
- Docker Bench repository or image version, including the benchmark version shown by the repository.
- Scan date and host identity.
- Checks excluded or selected with command-line options.
- Approved exceptions, their owners, expiry dates, and compensating controls.
Run the baseline host audit
The host-script approach is the least surprising starting point because it runs directly on the system being assessed and avoids introducing an additional privileged audit container.
- Clone the official repository. Run:
git clone https://github.com/docker/docker-bench-security.git - Enter the checkout.
cd docker-bench-security - Run all available checks with root privileges.
sudo sh docker-bench-security.sh - Preserve both report formats. Keep the operator-readable text output and the generated JSON output with the metadata listed above. Do not edit the original files; make annotations in a separate ticket or evidence record.
By default, Docker Bench runs all available CIS tests. The text report is useful during an interactive review because it presents the finding and remediation guidance in a form an operator can read quickly. The JSON report is better for structured storage, dashboards, evidence retention, and comparing repeated scans.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Run only selected checks when investigating a finding
A full baseline is the right first scan, but selectors help when you are validating one change or troubleshooting a particular control.
| Purpose | Command | Use case |
|---|---|---|
| Run one check | sh docker-bench-security.sh -c check_2_2 |
Re-test a single control after changing its configuration. |
| Exclude one check | sh docker-bench-security.sh -e check_2_2 |
Run the remaining checks when a documented exception must be omitted temporarily. |
| Run an area while excluding one check | sh docker-bench-security.sh -c container_images -e check_4_5 |
Focus on the container-image area without running a control that is not applicable. |
Check identifiers normally look like check_2_6. Community checks use the form check_c_<number>. Record every selector and exclusion beside the resulting logs; otherwise a later reader may mistake a partial scan for a complete baseline.
Interpret PASS, WARN, and FAIL correctly
PASS
A PASS means the condition tested by that control matched the benchmark rule at scan time. It does not certify the entire host, prove that an image is safe, or show that an attacker cannot exploit an unrelated weakness.
WARN or FAIL
A WARN or FAIL identifies a condition that needs review against the remediation text stated by the check. Start by confirming that the control applies to this host and that the observed configuration is current. Some findings are legitimate exceptions for a particular workload; others indicate drift from an approved baseline.
Assign the finding to the right owner
Use the benchmark scope to route work instead of treating the report as one undifferentiated score:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Host owner: operating-system permissions, audit configuration, service exposure, and host files.
- Docker daemon owner: daemon configuration, socket protection, authorization, and service startup settings.
- Runtime or platform owner: container execution behavior and isolation choices.
- Image or build owner: image provenance, image contents, and image lifecycle controls.
- Operations and security owners: logging, exception approval, monitoring, incident response, and evidence retention.
Do not apply a remediation mechanically in production. Hardening can affect availability, networking, storage, logging, image workflows, and application startup. Test the proposed change in staging or an equivalent maintenance process, document the result, and schedule a controlled rollout.
Understand the containerized execution option
Docker also publishes instructions for running Docker Bench from a container. This can simplify distribution and make repeated execution easier, but it is not an ordinary unprivileged container. Parts of the benchmark inspect the running host, so the published invocation uses substantial access.
| Option or mount | Why it is used | Security implication |
|---|---|---|
--net host |
Lets the audit observe the host network namespace. | The audit container shares host networking rather than receiving an isolated container network. |
--pid host |
Lets checks inspect host processes. | Processes in the host namespace become visible to the container. |
--userns host |
Aligns user-namespace behavior with the host being assessed. | User isolation provided by a separate user namespace is not available for this container. |
--cap-add audit_control |
Permits checks that need audit-control operations. | The container receives an additional capability with host-level security impact. |
| Read-only mounts for host paths and Docker binaries | Provides the files and executables required by host checks. | Read-only reduces modification risk, but the mounted data can still expose sensitive system information. |
Read-only bind of /var/run/docker.sock |
Allows the script to query the Docker daemon. | Access to the Docker socket is highly privileged; treat the container as part of the host’s trusted computing base. |
Before using the container form, review every namespace, capability, mount, and image source against your organization’s policy. Pin the repository or image version so two scans do not silently use different benchmark code. Capture the same host metadata and logs as with the direct script. The host-script method avoids adding a privileged audit container, although it still requires root access for host checks.
Adjust paths for the operating system. Docker Desktop on macOS does not expose the same systemd, host-file, and binary paths as a native Linux Docker host, so a command designed for Linux may not assess the Desktop environment in the same way. Do not interpret missing Linux paths as evidence that an equivalent control is secure or insecure; first establish whether that control applies to the platform.
Recommended Free Tools
Build a remediation workflow instead of chasing a score
1. Triage the report
Sort findings by scope and operational risk. A daemon or host control that affects every workload may deserve a different change window from an image-specific issue. Confirm whether the finding came from the full scan or a selected subset.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
2. Read the check’s remediation text
The text output includes operator-oriented remediation notes. Treat those notes as the starting point, then consult the applicable CIS guidance and your organization’s standards. Verify that the suggested setting matches the Docker Engine release, Linux distribution, and workload requirements.
3. Validate in staging
Apply the proposed configuration to a representative environment. Exercise image pulls, container startup, networking, persistent storage, logging, backups, and administrative access. A setting that improves one benchmark control can break an application dependency or reduce the evidence needed for another control.
4. Re-run the specific control
Use a selector such as -c check_2_2 to confirm the change quickly, then run a complete baseline after the maintenance window. Keep both reports so reviewers can see the immediate result and the broader effect.
5. Close or document exceptions
If a control cannot be implemented, record the reason, affected workloads, risk acceptance authority, compensating controls, and review date. Exclude the check only when the exclusion is intentional and visible in the evidence metadata.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare direct host execution with containerized execution
| Decision factor | Host script | Containerized audit |
|---|---|---|
| Privilege and blast radius | Runs with root on the host but does not add another privileged container. | Requires host namespaces, an audit capability, host mounts, and Docker-socket access. |
| Deployment | Requires cloning the repository and running the shell script on each target host. | Can standardize the runtime image, but the image and invocation must be approved and pinned. |
| Host-specific visibility | Direct access to host files, binaries, and audit interfaces. | Visibility depends on the mounts, namespaces, paths, and capabilities supplied to the container. |
| Repeatability | Repeatable when the repository revision and host metadata are recorded. | Repeatable when both the image version and privileged invocation are recorded. |
| Evidence collection | Writes logs directly on the audited host unless you redirect or collect them elsewhere. | Requires an explicit plan for copying logs out of the audit container and retaining them centrally. |
| Platform fit | Best suited to a native Linux Docker host. | Still depends on the container’s access to the underlying host; Desktop platforms may not expose equivalent paths. |
Make recurring scans comparable
A one-time scan shows a point-in-time configuration. A recurring compliance process is useful only when each run can be compared with the previous one. Pin the Docker Bench repository or image, record the benchmark version, retain the raw text and JSON outputs, and keep exclusions and exceptions in a centralized record.
Choose a schedule that matches your change rate and risk. Run an additional scan after Docker Engine upgrades, host rebuilds, daemon-configuration changes, or major image-policy changes. Give each finding a named owner and due date, and distinguish newly introduced failures from accepted exceptions that were present in an earlier baseline.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For automation, use the JSON output as the machine-readable evidence source and the text output as the human review artifact. Restrict automation to approved hosts and approved image or repository versions. Ensure that the account or job collecting the logs cannot silently alter the original evidence.
Troubleshoot common audit problems
The command is denied or checks cannot read host files
Confirm that the script is being run from the cloned repository and that the invoking account has the required root privileges. Review filesystem permissions and any host policy that blocks access to audit or daemon configuration. Do not solve a permission error by granting broader access than the check requires.
auditctl is unavailable
Docker Bench is designed to check /etc/audit/audit.rules when the distribution lacks auditctl. Record which path was available and verify that the resulting control is applicable to the host’s audit implementation.
The JSON output is difficult to inspect
Install jq if permitted; it is optional but recommended for working with the structured log. Keep the original JSON unchanged and create filtered views separately so evidence remains reproducible.
A containerized run reports missing paths or services
Compare the invocation’s mounts and namespaces with the host layout. Linux systemd paths and Docker binaries may not exist on Docker Desktop for macOS or on another non-Linux platform. A missing path can indicate an inapplicable control rather than a failed hardening measure.
A finding changes after an upgrade
Record the Docker Engine version, repository or image revision, and benchmark version for both scans. A changed result may reflect a real configuration change, a changed host, or updated test logic. Re-evaluate the remediation against the version now running instead of comparing only the PASS/FAIL label.
Know what Docker Bench cannot tell you
- It does not discover every software vulnerability in the host, daemon, kernel, or images.
- It does not prove that secrets are handled safely or that image contents are trustworthy.
- It does not provide runtime threat detection or replace incident response.
- It does not establish that a workload is available, performant, or compatible after hardening.
- It does not produce a universal security score; applicability, exceptions, and platform differences matter.
Use the report as configuration evidence within a broader security program. Combine it with patch management, image review, secrets controls, monitoring, logging, and tested response procedures.
Quick Recap
A practical audit checklist
- Confirm the target is a native Linux Docker host and note the Docker Engine version.
- Clone the approved Docker Bench repository revision.
- Run
sudo sh docker-bench-security.shfor the baseline. - Retain the text and JSON logs with date, host, benchmark version, and exclusions.
- Route each finding to the host, daemon, runtime, image, or operations owner.
- Validate remediation in staging before changing production.
- Re-run selected checks, then perform a complete scan after approved changes.
- Document exceptions, compensating controls, owners, and review dates.
- For containerized execution, review every namespace, capability, mount, socket bind, and image version before launch.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
