Docker Bench for Security

Docker Bench for Security checks Docker deployments against common best practices for running containers in production. Its automated tests follow the CIS Docker Benchmark v1.6.0, letting you self-assess hosts and containers against that baseline.

The script runs from a base host or inside a Docker container. You can run all tests or target specific check IDs and groups, exclude checks, filter by container or image name, and limit reported items in JSON output. Results are written as JSON and plain text logs, and remediation steps print by default.

It requires Docker 1.13.0 or later. The tool runs locally with broad host access rather than as a hosted service, and it supports running on Docker Desktop for macOS with a few path adjustments.