Cybersecurity-Projects/PROJECTS/intermediate/docker-security-audit/tests/testdata

Test Fixtures for Docker Security Audit

This directory contains test fixtures for integration testing of the docksec tool.

Directory Structure

testdata/
├── dockerfiles/       # Dockerfile test cases
├── compose/          # Docker Compose test cases
└── containers/       # Container inspect JSON samples

---

Dockerfiles

Bad Examples (Should Trigger Findings)

bad-secrets.Dockerfile

Expected Findings:

• CRITICAL: AWS credentials hardcoded (AWS_SECRET_ACCESS_KEY)
• CRITICAL: GitHub token in environment
• CRITICAL: Stripe secret key
• CRITICAL: OpenAI API key
• CRITICAL: Database URL with password
• HIGH: API_KEY, PASSWORD, JWT_SECRET in env vars
• CRITICAL: Private key content

Test Purpose: Verify secret detection in ENV directives and RUN commands

---

bad-root-user.Dockerfile

Expected Findings:

• MEDIUM: No USER directive (runs as root)
• HIGH: Installing sudo in container
• MEDIUM: No HEALTHCHECK defined
• INFO: Using apt-get without cleanup in some layers

Test Purpose: Verify user privilege checks

---

bad-privileged.Dockerfile

Expected Findings:

• CRITICAL: Using latest tag
• HIGH: Installing Docker CLI (pattern for docker.sock mounting)
• MEDIUM: World-writable permissions (chmod 777)
• MEDIUM: No USER directive

Test Purpose: Verify base image and permission checks

---

bad-add-command.Dockerfile

Expected Findings:

• MEDIUM: Using ADD instead of COPY
• MEDIUM: No USER directive
• HIGH: npm install as root
• MEDIUM: No --production flag for npm
• MEDIUM: Multiple exposed ports including debug ports (9229, 9230)
• MEDIUM: No HEALTHCHECK

Test Purpose: Verify Dockerfile best practices

---

Good Examples (Should Pass)

good-minimal.Dockerfile

Expected: No critical/high findings

Features:

• Specific version tag (alpine:3.19)
• Non-root user (appuser, UID 1000)
• Proper file ownership
• HEALTHCHECK present
• Minimal attack surface

---

good-security.Dockerfile

Expected: No findings (perfect security)

Features:

• Specific version tag with digest
• Non-root user
• Production dependencies only
• npm cache cleaned
• Immutable filesystem (chmod -R 555)
• HEALTHCHECK
• Tini init process
• Proper signal handling

---

Docker Compose Files

Bad Examples

bad-docker-socket.yml

Expected Findings:

• CRITICAL: privileged: true
• CRITICAL: Docker socket mounted
• CRITICAL: /etc/passwd mounted
• CRITICAL: /root/.ssh mounted
• CRITICAL: CAP_SYS_ADMIN capability
• CRITICAL: CAP_NET_ADMIN capability
• CRITICAL: CAP_SYS_PTRACE capability
• MEDIUM: network_mode: host
• CRITICAL: AWS credentials in environment

Test Purpose: Most dangerous configuration possible

---

bad-privileged.yml

Expected Findings:

• CRITICAL: privileged: true
• HIGH: pid: host
• HIGH: ipc: host
• CRITICAL: Root filesystem mounted (/)
• CRITICAL: /proc mounted
• CRITICAL: /sys mounted
• MEDIUM: No resource limits
• MEDIUM: No restart policy

Test Purpose: Host namespace access patterns

---

bad-caps.yml

Expected Findings:

• CRITICAL: CAP_SYS_MODULE
• CRITICAL: CAP_SYS_RAWIO
• CRITICAL: CAP_SYS_PTRACE
• CRITICAL: CAP_SYS_ADMIN
• HIGH: CAP_DAC_OVERRIDE
• CRITICAL: CAP_MAC_ADMIN
• HIGH: CAP_NET_ADMIN
• CRITICAL: CAP_BPF
• HIGH: /lib/modules mounted
• CRITICAL: /dev mounted

Test Purpose: Dangerous Linux capabilities

---

bad-mounts.yml

Expected Findings:

• CRITICAL: Docker socket mounted
• CRITICAL: Containerd socket mounted
• CRITICAL: /etc, /etc/passwd, /etc/shadow mounted
• CRITICAL: /root and subdirectories mounted
• CRITICAL: Kubernetes directories mounted
• CRITICAL: /dev, /proc, /sys mounted
• HIGH: /boot, /lib/modules mounted
• CRITICAL: /var/lib/docker mounted
• HIGH: /var/log mounted

Test Purpose: Sensitive filesystem mounts

---

bad-secrets.yml

Expected Findings:

• Multiple CRITICAL findings for hardcoded secrets:
  • AWS credentials
  • Database URLs with passwords
  • API keys (Stripe, GitHub, OpenAI, Google, Azure)
  • JWT/Session secrets
  • Private keys
  • Database passwords

Test Purpose: Environment variable secret detection

---

bad-no-limits.yml

Expected Findings:

• MEDIUM: No memory limits
• MEDIUM: No CPU limits
• MEDIUM: No PID limits
• MEDIUM: No restart policy
• MEDIUM: No health check
• MEDIUM: No USER directive
• MEDIUM: Not read-only filesystem
• MEDIUM: No security options
• MEDIUM: No capabilities dropped

Test Purpose: Resource limits and hardening options

---

Good Example

good-production.yml

Expected: No critical/high findings

Features:

• Specific image tags with versions
• Non-root users (1000:1000, node:node)
• Read-only root filesystem
• Tmpfs for writable directories
• Security options (no-new-privileges, apparmor)
• Capabilities dropped (ALL) then minimal added
• Resource limits (CPU, memory)
• Health checks
• Restart policies
• Network isolation
• Secrets management (not env vars)
• Safe volume mounts (read-only configs)

---

Container Inspect JSONs

privileged-container.json

Expected Findings:

• CRITICAL: Privileged mode
• HIGH: PID host mode
• HIGH: IPC host mode
• MEDIUM: Network host mode
• CRITICAL: Docker socket mounted
• CRITICAL: Multiple dangerous capabilities
• CRITICAL: Sensitive host paths mounted
• CRITICAL: Secrets in environment
• MEDIUM: No resource limits
• MEDIUM: No restart policy
• MEDIUM: Running as root (empty User)
• MEDIUM: No health check

Test Purpose: Container runtime configuration checks

---

secure-container.json

Expected: No critical/high findings

Features:

• Non-privileged
• Non-root user (1000:1000)
• Isolated namespaces (no host mode)
• Capabilities dropped (ALL) + minimal added
• Security options enabled
• Read-only root filesystem
• Tmpfs for writable directories
• Resource limits configured
• Restart policy set
• Health check configured
• Safe volume mounts

Test Purpose: Secure container configuration

---

Usage in Tests

// Example: Test Dockerfile analyzer
func TestDockerfileAnalyzer(t *testing.T) {
    analyzer := analyzer.NewDockerfileAnalyzer()

    // Test bad case
    findings, err := analyzer.Analyze("testdata/dockerfiles/bad-secrets.Dockerfile")
    require.NoError(t, err)
    assert.True(t, findings.HasSeverityAtOrAbove(finding.SeverityCritical))
    assert.Contains(t, findings, "hardcoded-secrets")

    // Test good case
    findings, err = analyzer.Analyze("testdata/dockerfiles/good-security.Dockerfile")
    require.NoError(t, err)
    assert.False(t, findings.HasSeverityAtOrAbove(finding.SeverityHigh))
}

---

Test Matrix

File	Secrets	Privileged	Caps	Mounts	User	Limits	Health
bad-secrets.Dockerfile	✓	-	-	-	✗	-	✗
bad-root-user.Dockerfile	-	-	-	-	✗	-	✗
bad-privileged.Dockerfile	-	pattern	-	-	✗	-	-
bad-add-command.Dockerfile	-	-	-	-	✗	-	✗
bad-docker-socket.yml	✓	✓	✓	✓	✗	✗	✗
bad-privileged.yml	-	✓	-	✓	✗	✗	✗
bad-caps.yml	-	-	✓	✓	✗	-	-
bad-mounts.yml	-	-	-	✓	✗	-	-
bad-secrets.yml	✓	-	-	-	-	-	-
bad-no-limits.yml	-	-	-	-	✗	✗	✗
good-minimal.Dockerfile	✗	✗	✗	✗	✓	-	✓
good-security.Dockerfile	✗	✗	✗	✗	✓	✓	✓
good-production.yml	✗	✗	✓	✓	✓	✓	✓

Legend:

• ✓ = Has this security feature/issue
• ✗ = Does not have this issue / Has protection
• - = Not applicable