docker

docker-bench-security: Check Docker Hosts Against the CIS Benchmark

Docker Bench for Security is a Shell script that checks Docker hosts and containers against the CIS Docker Benchmark. It automates production security checks and helps teams identify areas to review and remediate.

QuietShellApache-2.0SecurityDockerCLI Tool
View on GitHub Compare
Stars
9.7k
Forks
1k
Last commit
5 months ago
Contributors
65
Releases, 12 months
0

Our take

Quietno commits in the last 90 days and no release in a year

Health score

30/100

How it is scored
Activity
20
Community
58
Issues
21
Pull requests
21

This is a focused, practical Docker security assessment script, but its quiet recent activity means teams should verify that its checks still match their environment and benchmark needs.

Good fit if

  • You run Docker and want automated checks based on the CIS Docker Benchmark.
  • Your team can review findings and apply remediation to the host or containers.
  • You are comfortable running Shell scripts or building the supplied Docker image, under the Apache-2.0 license.

Look elsewhere if

  • You need a tool with recent releases or active recent development: the project is marked quiet, with no commits in the last 90 days and no release in over a year.
  • You need evidence of recent issue resolution or merged contributions: none were recorded in the last 90 days.
  • Your environment is not Docker-based or you need a different security assessment scope.
All health signals
Last commit2026-06-04 (5 months ago)
Commits, last 90 days0
Releases, last 12 months0 (latest v1.6.1, 2023-12-20)
Contributors65 (top contributor: 74% of commits)
Issues closed, last 90 days0
Pull requests merged, last 90 days0
Project age11 years

Checked on 2026-10-24 with the GitHub API.

Overview

Docker Bench for Security is a Shell script built around the CIS Docker Benchmark, an industry benchmark for assessing Docker security. It automates checks of Docker hosts and containers so teams can identify common security-practice gaps before or during production deployment.

It is aimed at operators and security teams running Docker. You can run it directly on a host or build and run it in a container; the container approach shares host namespaces and files because some checks inspect the host itself.

Key Features

  • Runs automated checks based on the CIS Docker Benchmark.
  • Checks Docker host configuration and running containers.
  • Runs on the base host or as a Docker container.
  • Supports selecting checks to run or exclude by check ID or group.
  • Allows filtering containers and images by name patterns or labels.
  • Writes text and JSON logs, with options to limit reported items and suppress remediation output.
  • Includes community-contributed checks alongside CIS-based checks.

Use Cases

  • A platform team can assess a Docker host before putting it into production and review reported gaps.
  • A security team can run selected benchmark checks as part of a host-hardening review.
  • An operator can check container and image settings across a Docker environment, filtering by name or label.
  • A team can rerun specific checks after configuration changes to examine the relevant results.

What you need

Detected in the repository

  • Shell (main language on GitHub)
  • A Dockerfile, so it can run in a container; a Compose file sets up the related services
  • A test suite and automated checks on GitHub Actions

License in plain words

Apache-2.0permissive

  • Commercial use: yes
  • Modify and redistribute: yes
  • You must keep: the license, the NOTICE file and a note of your changes
  • Share your changes: no
  • Includes an explicit patent grant from the contributors:

A summary, not legal advice: the LICENSE file is what applies.

Getting Started

Run from a Docker host:

git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
sudo sh docker-bench-security.sh

See the README for container usage, options, and platform-specific volume mounts.

Considerations

  • Some checks inspect the host, so running the container requires broad access to host namespaces, files, and the Docker socket. Review the supplied mounts and privileges before running it.
  • Docker 1.13.0 or later is required. jq is optional but recommended.
  • The README says the published docker/docker-bench-security image is out of date and a manual build is required. Container logs are written inside the container unless you mount a location for them.
  • The latest release is from 2023, and there have been no commits in the last 90 days. Check whether the included benchmark checks remain suitable for your Docker version and policies.
  • The project uses the Apache-2.0 license; review its terms when incorporating or distributing it.

Found this useful?

Share it with someone who would like docker-bench-security.