Skip to content

Commit f51d892

Browse files
committed
update Readme
1 parent 9450a10 commit f51d892

File tree

1 file changed

+36
-7
lines changed

1 file changed

+36
-7
lines changed

README.md

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ We are making this available as an open-source utility so the Docker community c
88

99
| Release | CIS |
1010
| :-----: | :----: |
11+
| 1.8.0 | 1.8.0 |
1112
| 1.6.0 | 1.6.0 |
1213
| 1.5.0 | 1.5.0 |
1314
| 1.3.6 | 1.4.0 |
@@ -24,7 +25,7 @@ You can simply run this script from your base host by running:
2425
```sh
2526
git clone https://github.com/docker/docker-bench-security.git
2627
cd docker-bench-security
27-
sudo sh docker-bench-security.sh
28+
sudo bash docker-bench-security.sh
2829
```
2930

3031
> Note: [`jq`](https://jqlang.github.io/jq/) is an optional but recommended dependency.
@@ -128,6 +129,34 @@ Note that when distributions don't contain `auditctl`, the audit tests will chec
128129
-n LIMIT optional In JSON output, when reporting lists of items (containers, images, etc.), limit the number of reported items to LIMIT. Default 0 (no limit).
129130
-p PRINT optional Print remediation measures. Default: Don't print remediation measures.
130131
```
132+
Subsets of tests available :
133+
- cis
134+
- host_configuration
135+
- docker_daemon_configuration
136+
- docker_daemon_files
137+
- container_images
138+
- container_runtime
139+
- docker_security_operations
140+
- docker_swarm_configuration
141+
- cis_level1
142+
- host_configuration_level1
143+
- docker_daemon_configuration_level1
144+
- docker_daemon_files_level1
145+
- container_images_level1
146+
- container_runtime_level1
147+
- docker_security_operations_level1
148+
- docker_swarm_configuration_level1
149+
- cis_controls_v8_ig1
150+
- cis_controls_v8_ig2
151+
- cis_controls_v8_ig3
152+
- docker_enterprise_configuration
153+
- docker_enterprise_configuration_level1
154+
- docker_trusted_registry_configuration
155+
- universal_control_plane_configuration
156+
- community
157+
- community_checks
158+
- all
159+
131160
132161
By default the Docker Bench for Security script will run all available CIS tests and produce
133162
logs in the log folder from current directory, named `docker-bench-security.log.json` and
@@ -137,16 +166,16 @@ If the docker container is used then the log files will be created inside the co
137166
138167
The CIS based checks are named `check_<section>_<number>`, e.g. `check_2_6` and community contributed checks are named `check_c_<number>`.
139168
140-
`sh docker-bench-security.sh -c check_2_2` will only run check `2.2 Ensure the logging level is set to 'info'`.
169+
`bash docker-bench-security.sh -c check_2_2` will only run check `2.2 Ensure the logging level is set to 'info'`.
141170
142-
`sh docker-bench-security.sh -e check_2_2` will run all available checks except `2.2 Ensure the logging level is set to 'info'`.
171+
`bash docker-bench-security.sh -e check_2_2` will run all available checks except `2.2 Ensure the logging level is set to 'info'`.
143172
144-
`sh docker-bench-security.sh -e docker_enterprise_configuration` will run all available checks except the docker_enterprise_configuration group
173+
`bash docker-bench-security.sh -e docker_enterprise_configuration` will run all available checks except the docker_enterprise_configuration group
145174
146-
`sh docker-bench-security.sh -e docker_enterprise_configuration,check_2_2` will run all available checks except the docker_enterprise_configuration group and `2.2 Ensure the logging level is set to 'info'`
175+
`bash docker-bench-security.sh -e docker_enterprise_configuration,check_2_2` will run all available checks except the docker_enterprise_configuration group and `2.2 Ensure the logging level is set to 'info'`
147176
148-
`sh docker-bench-security.sh -c container_images,container_runtime` will run just the container_images and container_runtime checks
177+
`bash docker-bench-security.sh -c container_images,container_runtime` will run just the container_images and container_runtime checks
149178
150-
`sh docker-bench-security.sh -c container_images -e check_4_5` will run just the container_images checks except `4.5 Ensure Content trust for Docker is Enabled`
179+
`bash docker-bench-security.sh -c container_images -e check_4_5` will run just the container_images checks except `4.5 Ensure Content trust for Docker is Enabled`
151180
152181
Note that when submitting checks, provide information why it is a reasonable test to add and please include some kind of official documentation verifying that information.

0 commit comments

Comments
 (0)