2 releases 4 tags

RSS feed

• v1.2.1 2097053705

  Compare

  docker-baseline-auditor v1.2.1 Stable

  Ghost released this 2026-10-17 01:50:04 -07:00 | 17 commits to master since this release

  • CIS 5.15 now follows the benchmark's audit: a restart policy that restarts without bound (always,
    unless-stopped, on-failure with no cap or more than 5 retries) is reported; no restart policy at all
    is compliant (it used to be the other way round). Found by the new Docker Bench differential suite.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor.git@v1.2.1
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor/releases/download/v1.2.1/docker_baseline_auditor-1.2.1-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor/releases/download/v1.2.1/docker_baseline_auditor.py
  

  SHA-256

  faaf6ec3e771c58ec705b0f1d73ef45372563b10bfca36965473ed14c36517a4  docker_baseline_auditor.py
  8c6b3b5880a2dc2047269e748de80540c0b4e8c381dd4eab692036a36837b778  docker_baseline_auditor-1.2.1-py3-none-any.whl
  0cc260b5d597ddd759e3ac1d828ce5ddd7d7524c87d8dc350dc7d9ccb02d7b03  docker_baseline_auditor-1.2.1.tar.gz
  

  Downloads

  • docker_baseline_auditor-1.2.1-py3-none-any.whl
    28 downloads · 2026-10-17 03:22:48 -07:00 · 12 KiB
  • docker_baseline_auditor-1.2.1.tar.gz
    28 downloads · 2026-10-17 03:22:48 -07:00 · 23 KiB
  • docker_baseline_auditor.py
    28 downloads · 2026-10-17 03:22:48 -07:00 · 20 KiB
  • SHA256SUMS
    28 downloads · 2026-10-17 03:22:49 -07:00 · 309 B

  ---

  • Source code (ZIP)
    10 downloads
  • Source code (TAR.GZ)
    9 downloads
• v1.2.0 097300d7b1

  Compare

  docker-baseline-auditor v1.2.0 Stable

  Ghost released this 2026-10-16 19:55:00 -07:00 | 20 commits to master since this release

  • CI gate fixed: the tool used to exit 0 after every run even with HIGH findings. It now exits 1 when
    any finding is at or above --fail-on (default high; medium, low or never also accepted).
  • Every finding carries its CIS Docker Benchmark v1.6.0 id; --include/--exclude select checks by id or section.
  • New daemon checks: icc on the default bridge (2.2), log level (2.3), insecure registries (2.5), aufs (2.6),
    TCP socket without TLS (2.7), user namespaces/rootless (2.9), centralized logging (2.13), no-new-privileges
    default (2.14), live restore (2.15), userland proxy (2.16), experimental features (2.18), read from
    docker info, the default bridge, daemon.json and the local dockerd command line.
  • New host file checks (local daemon only): docker.service/docker.socket, /etc/docker, daemon.json and the
    Docker socket owner and mode (3.1-3.6, 3.15-3.18). Docker Content Trust (4.5).
  • New container checks: sensitive host paths mounted (5.6), privileged host ports (5.8), writable root
    filesystem (5.13), ports published on every interface (5.14), host devices (5.18), shared mount propagation
    (5.20), host UTS/user namespaces (5.21/5.31), no-new-privileges (5.26), health check (5.27), pids limit (5.29).
  • --all also audits stopped containers.
  • Breaking: --json is now an object (version, engine, daemon, containers, summary) and each
    finding is {"id", "severity", "message"} instead of a [severity, message] pair.
  • The script is now docker_baseline_auditor.py (an importable module name); the command is docker-baseline-auditor.
  • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor.git
    puts a docker-baseline-auditor command on PATH (pyproject.toml, MIT license metadata).
  • --version flag.
  • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
  • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
  • CI installs the package with pip in a clean venv and checks --version/--help on every push.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor.git@v1.2.0
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor/releases/download/v1.2.0/docker_baseline_auditor-1.2.0-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/docker-baseline-auditor/releases/download/v1.2.0/docker_baseline_auditor.py
  

  SHA-256

  a5b770f9d4d20b0b3aae9eafe202af1909f94a33644794672dffdd1b56636640  docker_baseline_auditor.py
  740df40a289d13e75d29fff6a36c4f6bf97e309317c60ef2173853a4078d2894  docker_baseline_auditor-1.2.0-py3-none-any.whl
  7306611f376d8308b2fa0065df01cad21283e6a0187ce2eadb82afc1882fa46e  docker_baseline_auditor-1.2.0.tar.gz
  

  Downloads

  • docker_baseline_auditor-1.2.0-py3-none-any.whl
    2 downloads · 2026-10-16 19:55:41 -07:00 · 11 KiB
  • docker_baseline_auditor-1.2.0.tar.gz
    2 downloads · 2026-10-16 19:55:42 -07:00 · 15 KiB
  • docker_baseline_auditor.py
    2 downloads · 2026-10-16 19:55:41 -07:00 · 20 KiB
  • SHA256SUMS
    1 download · 2026-10-16 19:55:42 -07:00 · 309 B

  ---

  • Source code (ZIP)
    4 downloads
  • Source code (TAR.GZ)
    3 downloads