Docker Bench Security

Features

Security Configuration Auditing - Automates the inspection of Docker host and container configurations to identify security gaps and misconfigurations.
Security Audit Scripts - Provides a specialized script for auditing Docker deployments against industry security benchmarks.
Compliance Verification Tools - Automates the assessment and reporting of Docker deployments against international security and compliance standards.
Container Security - Evaluates container environments and host configurations against benchmarks to ensure adherence to security best practices.
Container Security Scanners - Scans Docker host settings and container deployments to identify critical security misconfigurations and vulnerabilities.
CIS Benchmark Implementations - Implements specific Center for Internet Security (CIS) benchmarks to evaluate Docker host and container configurations.
Container Security Hardening - Provides a workflow to identify vulnerabilities and apply security best practices to harden Docker container settings.
Security Benchmark Validations - Provides automated verification of system configurations against validated security reference profiles like the CIS benchmarks.
Security Audit Engines - Implements a shell-scripted engine to execute a sequence of configuration checks against a security baseline.
Customizable Security Checks - Allows for the selection and customization of specific security checks to target particular deployment domains.
Compliance & Audit Tools - Generates detailed audit reports in multiple formats to document compliance with security standards.
Container-Host Configuration Auditing - Analyzes differences between the host operating system and container runtime to identify potential security gaps.
Test Execution Filtering - Allows users to select specific subsets of security checks for execution via command line arguments.
Cloud Native Security - Audits Docker containers against CIS benchmarks.
Container Management - Audits Docker deployments against security best practices.
Container Security - Benchmarking Docker configurations against CIS standards.
Infrastructure as Code Analysis - Checks container deployments against security best practices.
Cloud and Container Security - Checks container deployments against industry-standard security benchmarks.
Cloud Security - Checks Docker containers against CIS security benchmarks.
Container Security Tools - Automated script to check for production deployment best practices.
Security And Hardening - Checks for production security best practices.

Open-source alternatives to Docker Bench Security

Similar open-source projects, ranked by how many features they share with Docker Bench Security.

aquasecurity/trivy
aquasecurity/trivy
36,462View on GitHub
Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai
Gocontainersdevsecopsdocker
View on GitHub36,462
quay/clair
quay/clair
11,012View on GitHub
Clair is a container image vulnerability scanner and security analyzer. It performs static analysis of container images by matching package contents against vulnerability databases to identify security risks across different package formats and architectures. The project functions as both an image indexer and a vulnerability database manager. It processes container layers into intermediate representations to enable fast security lookups and synchronizes security metadata from multiple external sources to maintain a local registry. Capability areas include continuous security monitoring, whic
Goclaircontainersdocker
View on GitHub11,012
cdk-team/cdk
cdk-team/CDK
4,692View on GitHub
CDK is a specialized toolset for container security auditing, container escape exploitation, and cloud infrastructure pentesting. It provides a collection of scripts and tools designed to identify and exploit vulnerabilities in container runtimes to break out of isolated environments and execute commands on the underlying host operating system. The project features a dedicated Docker runtime exploit suite for abusing the Docker API, procfs, and cgroups to gain unauthorized host-level access. It includes specific techniques for bypassing isolation via LXCFS, user namespace exploitation, and ho
Go
View on GitHub4,692
falcosecurity/falco
falcosecurity/falco
8,670View on GitHub
Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments
C++cloud-nativecncfcncf-project
View on GitHub8,670

See all 30 alternatives to Docker Bench Security

dockerdocker-bench-security

Features

Open-source alternatives to Docker Bench Security

aquasecurity/trivy

quay/clair

cdk-team/CDK

falcosecurity/falco

Star history

Open-source alternatives to Docker Bench Security

aquasecurity/trivy

quay/clair

cdk-team/CDK

falcosecurity/falco