CanuteTheGreat/docker-baseline-auditor
Watch
1
0
Fork
You've already forked docker-baseline-auditor
 0
Code Issues Pull requests Projects Releases Wiki Activity Actions
No description
1 commit 1 branch 0 tags 3.4 KiB
  • Python 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
CanuteTheGreat 6503752e04 docker-baseline-auditor: read-only Docker security baseline checker 
Checks running containers for privileged mode, host namespace sharing,
docker.sock mounts, root users, missing memory limits, :latest tags,
disabled AppArmor/Seccomp, and added capabilities. Zero dependencies
beyond a working docker CLI. Read-only, never modifies containers.
2026-09-15 16:35:05 -07:00
docker-baseline-auditor.py docker-baseline-auditor: read-only Docker security baseline checker 2026-09-15 16:35:05 -07:00
README.md docker-baseline-auditor: read-only Docker security baseline checker 2026-09-15 16:35:05 -07:00

README.md

docker-baseline-auditor

Read-only Docker security baseline checker. Zero dependencies beyond a working docker CLI on the host you run it on (checks the containers already running there -- it does not scan remote hosts or images).

Roughly CIS Docker Benchmark-adjacent checks:

  • privileged mode
  • host network / PID / IPC namespace sharing
  • Docker socket mounted into a container (classic escape vector)
  • containers running as root
  • missing memory limits / restart policies
  • :latest tag usage
  • disabled AppArmor/Seccomp (--security-opt ... unconfined)
  • added Linux capabilities (--cap-add)

Usage

python3 docker-baseline-auditor.py          # human-readable
python3 docker-baseline-auditor.py --json   # machine-readable, for CI

Read-only. Runs docker ps / docker inspect only, never modifies containers. No network calls, no data leaves the host.

License / pricing

Free, pay-what-you-want. If it's useful: https://errant.solutions/tools.html (payment link on that page). No obligation.

Part of the Errant Solutions spare-capacity tools series (see also: sshd-hardening-auditor, tls-cert-watchdog, mail-security-auditor, aws-waste-finder).