- A Cloud Guru
Using Docker Bench to Enhance Container Security
This lab allows the student to explore the Docker Bench utility for hardening Docker installations. The student gains access to the lab server via SSH, and clones the Docker Bench repo from github.com. Then the student executes the bench utility, views the report, and then enables auditing of the Docker Daemon. After enabling auditing, the utility is run again and the new report is compared with the old.
Table of Contents
Clone the Docker Bench repo from GitHub into the current working directory.
Clone the docker bench repo from GitHub:
$ git clone https://github.com/docker/docker-bench-security.git
Change directory to the docker-bench-security directory and run the docker-bench-security script.
Change your present working directory to docker-bench-security:
$ cd docker-bench-security
Using superuser permissions execute the docker-bench-security.sh shell script and redirect standard output to a file called /tmp/bench1.out
$ sudo sh docker-bench-security.sh > /tmp/bench1.out
*The sudo command will prompt your for the cloud_user password
After running the report, you may look at the contents with the Linux
$ more /tmp/bench1.out
Update the audit rules on the server to include auditing the Docker Daemon
To list the rules already setup on the host, you may enter:
$ sudo auditctl -l
Use the auditctl command to add a rule to audit the Docker files in
$ sudo auditctl -w /var/lib/docker -k "docker lib"
This will setup auditing on the docker daemon. To check you may enter the -l command again.
$ sudo auditctl -l
Run the Docker Bench security utility again and compare the output with the first run.
Now run the docker bench utility again and direct output to /tmp/bench2.out:
$ sudo sh docker-bench-security.sh > /tmp/bench2.out
To view the new report contanets, you may use the
$ more /tmp/bench2.out
Now use the Linux diff command to compare the output from the first run in bench1.out to the second run in bench2.out:
$ diff /tmp/bench1.out /tmp/bench2.out
What's a lab?
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.