66 lines
3.6 KiB
Markdown
66 lines
3.6 KiB
Markdown
```regex
|
|
██████╗ ██████╗ ██████╗██╗ ██╗███████╗███████╗ ██████╗
|
|
██╔══██╗██╔═══██╗██╔════╝██║ ██╔╝██╔════╝██╔════╝██╔════╝
|
|
██║ ██║██║ ██║██║ █████╔╝ ███████╗█████╗ ██║
|
|
██║ ██║██║ ██║██║ ██╔═██╗ ╚════██║██╔══╝ ██║
|
|
██████╔╝╚██████╔╝╚██████╗██║ ██╗███████║███████╗╚██████╗
|
|
╚═════╝ ╚═════╝ ╚═════╝╚═╝ ╚═╝╚══════╝╚══════╝ ╚═════╝
|
|
```
|
|
|
|
[](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/main/PROJECTS/intermediate/docker-security-audit)
|
|
[](https://go.dev)
|
|
[](https://www.gnu.org/licenses/agpl-3.0)
|
|
[](https://goreportcard.com/report/github.com/CarterPerez-dev/docksec)
|
|
[](https://www.docker.com)
|
|
|
|
> Docker security audit CLI that checks containers, images, and Dockerfiles against CIS Docker Benchmark v1.6.0.
|
|
|
|
*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
|
|
|
|
## What It Does
|
|
|
|
- Scans running containers, images, Dockerfiles, and compose files for misconfigurations
|
|
- Checks against CIS Docker Benchmark v1.6.0 with severity scoring
|
|
- Detects privileged containers, dangerous capabilities, socket mounts, and namespace sharing
|
|
- Outputs terminal (colored), JSON, SARIF (GitHub Security tab), and JUnit formats
|
|
- Supports severity filtering and fail-on-critical for CI/CD pipelines
|
|
- Validates AppArmor/seccomp profiles, resource limits, and user namespace remapping
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
go install github.com/CarterPerez-dev/docksec/cmd/docksec@latest
|
|
docksec scan
|
|
```
|
|
|
|
> [!TIP]
|
|
> This project uses [`just`](https://github.com/casey/just) as a command runner. Type `just` to see all available commands.
|
|
>
|
|
> Install: `curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin`
|
|
|
|
## Commands
|
|
|
|
```bash
|
|
docksec scan # scan all targets with colored output
|
|
docksec scan --format sarif -o results.sarif # export SARIF for GitHub Security tab
|
|
docksec scan --severity critical,high # filter by severity
|
|
docksec scan --fail-on critical # exit non-zero for CI pipelines
|
|
```
|
|
|
|
## Learn
|
|
|
|
This project includes step-by-step learning materials covering security theory, architecture, and implementation.
|
|
|
|
| Module | Topic |
|
|
|--------|-------|
|
|
| [00 - Overview](learn/00-OVERVIEW.md) | Prerequisites and quick start |
|
|
| [01 - Concepts](learn/01-CONCEPTS.md) | Security theory and real-world breaches |
|
|
| [02 - Architecture](learn/02-ARCHITECTURE.md) | System design and data flow |
|
|
| [03 - Implementation](learn/03-IMPLEMENTATION.md) | Code walkthrough |
|
|
| [04 - Challenges](learn/04-CHALLENGES.md) | Extension ideas and exercises |
|
|
|
|
|
|
## License
|
|
|
|
AGPL 3.0
|