Contributing to Docker Bench for Security
Want to hack on Docker Bench? Awesome! Here are instructions to get you started.
The Docker Bench for Security is a part of the Docker project, and follows the same rules and principles. If you're already familiar with the way Docker does things, you'll feel right at home.
Otherwise, go read Docker's contributions guidelines.
Development Environment Setup
The only thing you need to hack on Docker Bench for Security is a POSIX 2004 compliant shell. We try to keep the project compliant for maximum portability.
You can build the container that wraps the docker-bench for security:
git clone email@example.com:docker/docker-bench-security.git cd docker-bench-security docker build -t docker-bench-security .
Or you can simply run the shell script locally:
git clone firstname.lastname@example.org:docker/docker-bench-security.git cd docker-bench-security sudo sh docker-bench-security.sh
The Docker Bench has the main script called
This is the main script that checks for all the dependencies, deals with
command line arguments and loads all the tests.
The tests are split into the following files:
tests/ ├── 1_host_configuration.sh ├── 2_docker_daemon_configuration.sh ├── 3_docker_daemon_configuration_files.sh ├── 4_container_images.sh ├── 5_container_runtime.sh ├── 6_docker_security_operations.sh └── 7_docker_swarm_configuration.sh
To modify the Docker Bench for Security you should first clone the repository,
make your changes, check your code with
checkbashisms or similar
tools, and then sign off on your commits. After that feel free to send us a
pull request with the changes.
While this tool was inspired by the CIS Docker 1.11.0 benchmark and its successors, feel free to add new tests. We will try to turn dockerbench.com into a list of good community benchmarks for both security and performance, and we would love community contributions.