Watch

No description

Python 100%

Find a file

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
Ronald Farrer 6eff0b1604 Fix silent swallow of docker CLI failures When the docker CLI is missing or docker ps/inspect fails (e.g. daemon unreachable, permission denied), the script previously ignored subprocess.run's returncode entirely and printed a misleading '0 containers checked, 0 findings' as if the host were clean. Now get_containers() raises DockerUnavailableError on a nonzero docker ps exit code or a missing docker binary (FileNotFoundError), main() catches it and prints a clear error (plain text to stderr, or an {"error": ...} object in --json mode) and exits with code 2 instead of a false-clean 0.	2026-09-30 17:34:40 -07:00
docker-baseline-auditor.py	Fix silent swallow of docker CLI failures	2026-09-30 17:34:40 -07:00
README.md	docker-baseline-auditor: read-only Docker security baseline checker	2026-09-15 16:35:05 -07:00

Ronald Farrer 6eff0b1604 Fix silent swallow of docker CLI failures

When the docker CLI is missing or docker ps/inspect fails (e.g. daemon
unreachable, permission denied), the script previously ignored
subprocess.run's returncode entirely and printed a misleading
'0 containers checked, 0 findings' as if the host were clean.

Now get_containers() raises DockerUnavailableError on a nonzero
docker ps exit code or a missing docker binary (FileNotFoundError),
main() catches it and prints a clear error (plain text to stderr, or
an {"error": ...} object in --json mode) and exits with code 2
instead of a false-clean 0.

2026-09-30 17:34:40 -07:00

docker-baseline-auditor.py

Fix silent swallow of docker CLI failures

2026-09-30 17:34:40 -07:00

README.md

docker-baseline-auditor: read-only Docker security baseline checker

2026-09-15 16:35:05 -07:00

README.md

docker-baseline-auditor

Read-only Docker security baseline checker. Zero dependencies beyond a working docker CLI on the host you run it on (checks the containers already running there -- it does not scan remote hosts or images).

Roughly CIS Docker Benchmark-adjacent checks:

privileged mode
host network / PID / IPC namespace sharing
Docker socket mounted into a container (classic escape vector)
containers running as root
missing memory limits / restart policies
:latest tag usage
disabled AppArmor/Seccomp (--security-opt ... unconfined)
added Linux capabilities (--cap-add)

Usage

python3 docker-baseline-auditor.py          # human-readable
python3 docker-baseline-auditor.py --json   # machine-readable, for CI

Read-only. Runs docker ps / docker inspect only, never modifies containers. No network calls, no data leaves the host.

License / pricing

Free, pay-what-you-want. If it's useful: https://errant.solutions/tools.html (payment link on that page). No obligation.

Part of the Errant Solutions spare-capacity tools series (see also: sshd-hardening-auditor, tls-cert-watchdog, mail-security-auditor, aws-waste-finder).