skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-docker-bench-security-assessment

Audits Docker hosts and containers against the CIS Docker Benchmark using Docker Bench for Security.

954|172|Updated Mar 13, 2026
Search Tags:#docker#container security#hardening#Security audit#CIS Benchmark#Compliance#docker bench
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-docker-bench-security-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-docker-bench-security-assessment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/performing-docker-bench-security-assessment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-docker-bench-security-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Docker deployments often ship with insecure defaults, and manually auditing host configuration, daemon settings, and container runtime flags against the CIS Docker Benchmark is slow and error-prone. This Skill runs Docker Bench for Security to produce a pass/fail/warn compliance report and guides remediation of common failures.

Core Features & Use Cases

  • CIS Benchmark Auditing: Runs the official docker/docker-bench-security container to check host configuration, daemon settings, images, and runtime controls.
  • Result Interpretation: Explains PASS/FAIL/WARN output, including why WARN items require manual review and why missing mounts silently skip checks.
  • Remediation Guidance: Provides concrete fixes such as setting icc and no-new-privileges in /etc/docker/daemon.json and restarting the daemon.
  • Use Case: A security engineer hardening a production Docker host runs the assessment, identifies that inter-container communication is unrestricted, applies the daemon.json fix, and re-runs the scan to verify the finding is resolved.

Quick Start

Run a Docker Bench security assessment against this host and summarize the failing CIS benchmark checks with remediation steps.

Frequently Asked Questions about performing-docker-bench-security-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run Docker Bench for Security against my Docker host?▼

Run the docker/docker-bench-security container with --net host, --pid host, --userns host, and read-only mounts of /etc, /var/lib, /usr/lib/systemd, and /var/run/docker.sock. It outputs a CIS benchmark report with PASS, FAIL, and WARN results per check.

What does Docker Bench for Security check?▼

Docker Bench audits host configuration, Docker daemon settings, container images, container runtime configurations, and security operations based on the CIS Docker Benchmark. It reports each control as PASS, FAIL, WARN, or INFO.

Does Docker Bench for Security cover Kubernetes clusters?▼

No. Docker Bench is host-scoped and audits only the single Docker daemon it can reach. It does not assess Kubernetes, containerd-only nodes, or other hosts, so cluster-wide posture requires separate tooling.

Why are some Docker Bench checks skipped or showing INFO?▼

Checks silently skip when required mounts are missing, such as /etc, /var/lib, /usr/lib/systemd, or docker.sock. Verify the total check count and confirm sections 2 (daemon) and 5 (runtime) actually ran rather than assuming a clean result.

How do I fix common Docker Bench failures like icc and no-new-privileges?▼

Set {"icc": false} and {"no-new-privileges": true} in /etc/docker/daemon.json, then run systemctl restart docker. Re-run Docker Bench afterward, since it reads live daemon state, to confirm the findings are resolved.

What are the limitations of Docker Bench for Security?▼

It only evaluates currently running containers, so insecure images not running at scan time are invisible, and it does not scan for image vulnerabilities. Pair it with an image scanner like Trivy or Grype for complete coverage.

Related Skills

Explore More Software Engineering Skills→
CruxExpertsCruxExperts
3

ls-linux-patcher

Automate Linux patching and Docker updates across hosts via SSH.

Community
Advanced
OpenHandsOpenHands
134

docker

Start a Docker daemon and run containers inside containerized environments.

Official
Advanced
RedHatProductSecurityRedHatProductSecurity
8

secdevai-oci-image-security

Analyze OCI container images for CVEs, misconfigurations, and supply chain risks.

Official
Advanced
jayjpatel9717jayjpatel9717

container-security

Scan Docker images and audit Kubernetes clusters for security vulnerabilities.

Community
Advanced