Documentation
¶
Overview ¶
Package dockerbench assesses a Docker host and daemon against the CIS Docker Benchmark (CAPABILITY_SPEC domain 10). It is a read-only auditor: it never mutates the host. Assessment runs against *collected evidence* — a snapshot of the daemon configuration, relevant file permissions, and per-container runtime settings — so a scan is deterministic and works fully offline. On a live host the collector reads the same inputs (daemon.json, `docker info`, file stats, `docker inspect`); in CI or tests the identical evidence document is committed as a fixture.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Assess ¶
func Assess(e *Evidence) *compliance.Report
Assess runs the full CIS Docker Benchmark against the evidence and returns the aggregated report. This is the single entry point used by both the module's Analyze and the `dsecrat bench docker` command.
func Benchmark ¶
func Benchmark() compliance.Benchmark
Benchmark returns the CIS Docker Benchmark control catalogue. It is pure data: the pass/fail logic lives in the check functions (daemon.go, files.go, runtime.go), keyed by control ID. Controls are authored grouped by section; the runner re-sorts them into stable numeric order.
func Register ¶
Register adds this module to the registry. The master agent calls this from modules.Default() during integration; this package never edits the shared registry file. See NOTES.md for the exact one-line wiring.
func RunCommand ¶
RunCommand implements `dsecrat bench docker [flags] <evidence-path>`. It is the exported command body the master wires into cli.go (see NOTES.md); this package owns the logic, the frontend owns the dispatch. Unlike Analyze, the command is a frontend and may read the wall clock.
Types ¶
type Container ¶
type Container struct {
Name string `json:"name"`
Privileged bool `json:"privileged,omitempty"`
CapAdd []string `json:"cap_add,omitempty"`
CapDrop []string `json:"cap_drop,omitempty"`
SecurityOpt []string `json:"security_opt,omitempty"`
PidMode string `json:"pid_mode,omitempty"`
IpcMode string `json:"ipc_mode,omitempty"`
UtsMode string `json:"uts_mode,omitempty"`
NetworkMode string `json:"network_mode,omitempty"`
ReadonlyRootfs bool `json:"readonly_rootfs,omitempty"`
User string `json:"user,omitempty"`
MemoryLimit int64 `json:"memory_limit,omitempty"`
PidsLimit int64 `json:"pids_limit,omitempty"`
RestartPolicy string `json:"restart_policy,omitempty"`
RestartMaxRetry int `json:"restart_max_retry,omitempty"`
Healthcheck bool `json:"healthcheck,omitempty"`
Mounts []Mount `json:"mounts,omitempty"`
PortBindings []PortBinding `json:"port_bindings,omitempty"`
}
Container is the runtime configuration of one container (from docker inspect), reduced to the fields CIS section 5 cares about.
type Evidence ¶
type Evidence struct {
// Daemon is the parsed daemon.json (raw, so new keys need no code change).
Daemon map[string]any `json:"daemon,omitempty"`
// Info is the subset of `docker info` that reflects effective daemon state.
Info Info `json:"info,omitempty"`
// Files are permission/ownership stats for security-relevant paths.
Files []FileStat `json:"files,omitempty"`
// Containers is the runtime config of running containers.
Containers []Container `json:"containers,omitempty"`
// Notes records collection gaps (e.g. "daemon.json unreadable"), surfaced
// to the operator without failing the scan.
Notes []string `json:"notes,omitempty"`
}
Evidence is the offline-assessable snapshot of a Docker host. Every field is optional; a missing field degrades the affected controls to INFO/unknown rather than failing the run.
func Load ¶
Load reads an evidence document for assessment. It accepts either a JSON evidence file, or a directory containing `evidence.json` (the collected snapshot) — and, failing that, a directory holding a real `daemon.json`, which it parses best-effort. A path that does not exist yields an empty Evidence with a Note, so the caller degrades to INFO rather than crashing.
type FileStat ¶
type FileStat struct {
Path string `json:"path"`
Exists bool `json:"exists"`
Mode string `json:"mode,omitempty"` // octal, e.g. "0644"
Owner string `json:"owner,omitempty"` // username or uid
Group string `json:"group,omitempty"` // group name or gid
}
FileStat is a security-relevant path with its ownership and mode.
type Info ¶
type Info struct {
ServerVersion string `json:"server_version,omitempty"`
Rootless bool `json:"rootless,omitempty"`
LiveRestore bool `json:"live_restore,omitempty"`
Experimental bool `json:"experimental,omitempty"`
LoggingDriver string `json:"logging_driver,omitempty"`
CgroupDriver string `json:"cgroup_driver,omitempty"`
SecurityOpts []string `json:"security_options,omitempty"` // e.g. "name=seccomp,profile=builtin"
StorageDriver string `json:"storage_driver,omitempty"`
}
Info mirrors the security-relevant fields of `docker info`. Effective values here take precedence when a daemon.json key is absent (a flag or default may still have set it).
type Module ¶
type Module struct{}
Module is the CIS Docker Benchmark capability (CAPABILITY_SPEC domain 10). It audits a Docker host/daemon from a collected evidence snapshot and projects each control result into the unified Finding model.
func (*Module) Analyze ¶
Analyze loads the evidence at the target location and runs the benchmark. Missing or unreadable inputs degrade to INFO controls rather than erroring, so the run never crashes on partial evidence. The continuous-compliance narrative (AI-age feature) stays OFF unless the caller opts in via the target metadata key "compliance.narrative"="true".
func (*Module) Description ¶
func (*Module) Supports ¶
func (m *Module) Supports(t engine.TargetType) bool
Supports handles filesystem targets (an evidence directory/file) and container targets. There is no dedicated host/daemon TargetType today; see NOTES.md for the proposed engine addition. The module stays quiet when the target holds no Docker evidence, so a plain filesystem scan is unaffected.
type Mount ¶
type Mount struct {
Source string `json:"source"`
Destination string `json:"destination"`
RW bool `json:"rw"`
}
Mount is a bind/volume mount, enough to spot sensitive host paths and the Docker socket being handed into a container.
type PortBinding ¶
type PortBinding struct {
HostIP string `json:"host_ip"`
HostPort int `json:"host_port"`
ContainerPort int `json:"container_port"`
}
PortBinding is a published port, enough to spot 0.0.0.0 exposure and privileged host ports.
Source Files