Docker Bench for Security: How to Audit Your Host

Updated 14 November 2026 · Standard formula, shown below

Docker Bench for Security is a script that checks your Docker host against a list of best-practice security recommendations. It scans your Docker daemon configuration, container settings, and file permissions, then reports each check as PASS, WARN, or INFO. This guide walks you through running the audit, understanding the output, and fixing common issues. You’ll need a machine with Docker installed and shell access (SSH) to that host.

What You’ll Need

A Linux server (or local machine) with Docker installed and running.
Root or sudo access to run the audit script.
Internet access to download the Docker Bench script (or you can clone the repository).
Basic familiarity with the command line.

Step-by-Step

Download Docker Bench for Security. The official script is hosted on GitHub. Clone the repository to your host:
```
git clone https://github.com/docker/docker-bench-security.git
```
Alternatively, you can download the script directly with wget or curl from the repository’s release page.
Navigate to the directory.
```
cd docker-bench-security
```
Make the script executable (if needed).
```
chmod +x docker-bench-security.sh
```
Run the audit. Use sudo to get the necessary permissions:
```
sudo ./docker-bench-security.sh
```
The script will start executing and display a series of checks, each prefixed with [PASS], [WARN], or [INFO]. The output is color-coded (green, yellow, blue) when run in a terminal.
Capture the output. To save the results for later review, redirect the output to a file:
```
sudo ./docker-bench-security.sh > audit-$(date +%Y%m%d).log 2>&1
```
This creates a timestamped log file in the current directory.
Review the results. Open the log file or scroll through the terminal output. Each check has a unique ID (e.g., 1.1.1, 2.5) and a description. Pay special attention to any WARN items—these indicate areas where your configuration deviates from recommended best practices.
Understand the check categories. The script groups checks into sections:
- Section 1: Host configuration (e.g., kernel hardening, file permissions)
- Section 2: Docker daemon configuration (e.g., network, logging, user namespace)
- Section 3: Container images and build files
- Section 4: Container runtime (e.g., capabilities, seccomp, read-only root)
- Section 5: Docker security operations (e.g., swarm mode, secrets)
Fix critical warnings. Start by addressing the most severe warnings. For example, if check 2.1 (network traffic between containers) warns that inter-container communication is allowed, you can disable it by adding "icc": false to the daemon configuration. Always test changes in a non-production environment first.
Re-run the audit. After making changes, re-run the script to confirm the warnings are resolved. It’s good practice to run this audit regularly, especially after upgrading Docker or changing host configurations.

Common Mistakes

Running without sudo. The script needs root privileges to read Docker’s configuration files and inspect processes. Running it as a normal user will result in many INFO or WARN results that are false positives.
Ignoring warnings that are acceptable for your use case. Some checks, like enabling user namespace remapping, may not be feasible in every environment. The script is a guide, not a strict compliance tool—evaluate each warning in context.
Not updating the script. Docker Bench is updated regularly to cover new Docker versions and vulnerabilities. Always pull the latest version before running an audit.
Copying fixes without understanding. Blindly applying every recommended setting can break your containers. For instance, setting --read-only on a container that needs to write to its filesystem will cause errors.

Tips

Use the -c flag to run a specific check. For example, sudo ./docker-bench-security.sh -c 2.2 runs only the check for the daemon user. This is useful when you’re working on a specific issue.
Integrate with CI/CD. You can run Docker Bench in a pipeline to automatically fail builds if critical warnings appear. Use the --exit-code flag to set a non-zero exit code when warnings are found.
Combine with other tools. Docker Bench is a starting point. Pair it with image scanning tools (like Trivy or Clair) and runtime monitoring for a more complete security posture.
Document your exceptions. If you intentionally deviate from a recommendation, note it in your security documentation so future audits don’t flag it as an oversight.

Troubleshooting

Script fails with “Permission denied”. Ensure you’re running with sudo and the script has executable permissions (chmod +x).
“Docker not found” error. The script expects Docker to be installed and the docker command in your PATH. Verify with which docker. If Docker is installed but not in the default path for the sudo environment, you may need to set DOCKER_BENCH_BIN or adjust your PATH.
Many checks show INFO instead of PASS. This usually means the check is not applicable to your environment (e.g., swarm mode checks on a non-swarm host). That’s normal—INFO means the script couldn’t determine a pass/fail, not that there’s a problem.
Script hangs or takes too long. Some checks, like those that inspect running containers, can be slow if you have many containers. Wait a bit longer, or run with -b to skip the container runtime checks (section 4) if you only care about host-level configuration.
Output is garbled or not color-coded. If you’re redirecting output to a file, the color codes may appear as escape characters. Use --no-color flag to disable colors for cleaner logs.

Frequently Asked Questions

What does a WARN result mean?

A WARN means the check found a configuration that deviates from Docker’s recommended security best practice. It doesn’t necessarily mean your host is vulnerable, but it’s a sign you should review and potentially fix the issue.

Is Docker Bench an official Docker tool?

Yes, Docker Bench for Security is maintained by Docker, Inc. and is hosted in the official docker/docker-bench-security GitHub repository. It’s widely used as a baseline security audit tool.

Can I run Docker Bench on a Windows or macOS Docker Desktop host?

The script is designed for Linux hosts. Docker Desktop on Windows or macOS runs Docker inside a lightweight VM, so you’d need to run the script inside that VM (e.g., via the Docker Desktop terminal) for accurate results.

How often should I run the audit?

It’s a good idea to run it after any significant change to your Docker host—like upgrading Docker, changing daemon flags, or altering host security settings. Many teams run it monthly or as part of their CI/CD pipeline.

Does passing all checks guarantee my Docker host is secure?

No. Docker Bench covers a specific set of best practices, but security is broader. You still need to manage network firewalls, OS patches, image vulnerabilities, and access controls. Think of it as a solid checklist, not a complete security solution.

Can I automate fixes based on the output?

Yes, but carefully. You can parse the output and apply corresponding daemon flags or container settings automatically. However, always test in a staging environment first, as some fixes may break existing workloads.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.