Skip to content

docker-security-audit

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

docker-security-audit

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
cmd/docksec
cmd/docksec
 
 
internal
internal
 
 
learn
learn
 
 
tests
tests
 
 
.gitignore
.gitignore
 
 
.golangci.yml
.golangci.yml
 
 
Dockerfile
Dockerfile
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 
go.mod
go.mod
 
 
go.sum
go.sum
 
 
justfile
justfile
 
 

README.md

██████╗  ██████╗  ██████╗██╗  ██╗███████╗███████╗ ██████╗
██╔══██╗██╔═══██╗██╔════╝██║ ██╔╝██╔════╝██╔════╝██╔════╝
██║  ██║██║   ██║██║     █████╔╝ ███████╗█████╗  ██║
██║  ██║██║   ██║██║     ██╔═██╗ ╚════██║██╔══╝  ██║
██████╔╝╚██████╔╝╚██████╗██║  ██╗███████║███████╗╚██████╗
╚═════╝  ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝╚══════╝ ╚═════╝

Cybersecurity Projects Go License: AGPLv3 Go Report Card Docker

Docker security audit CLI that checks containers, images, and Dockerfiles against CIS Docker Benchmark v1.6.0.

This is a quick overview — security theory, architecture, and full walkthroughs are in the learn modules.

What It Does

  • Scans running containers, images, Dockerfiles, and compose files for misconfigurations
  • Checks against CIS Docker Benchmark v1.6.0 with severity scoring
  • Detects privileged containers, dangerous capabilities, socket mounts, and namespace sharing
  • Outputs terminal (colored), JSON, SARIF (GitHub Security tab), and JUnit formats
  • Supports severity filtering and fail-on-critical for CI/CD pipelines
  • Validates AppArmor/seccomp profiles, resource limits, and user namespace remapping

Quick Start

go install github.com/CarterPerez-dev/docksec/cmd/docksec@latest
docksec scan

Tip

This project uses just as a command runner. Type just to see all available commands.

Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin

Commands

docksec scan                                    # scan all targets with colored output
docksec scan --format sarif -o results.sarif    # export SARIF for GitHub Security tab
docksec scan --severity critical,high           # filter by severity
docksec scan --fail-on critical                 # exit non-zero for CI pipelines

Learn

This project includes step-by-step learning materials covering security theory, architecture, and implementation.

Module Topic
00 - Overview Prerequisites and quick start
01 - Concepts Security theory and real-world breaches
02 - Architecture System design and data flow
03 - Implementation Code walkthrough
04 - Challenges Extension ideas and exercises

License

AGPL 3.0