‫Number two. Scan your host
‫for proper Docker config.
‫Here's a really great tool, free, called Docker Bench.
‫Made by Docker, this
‫tool will scan your host.
‫Basically you run it on the host that has Docker installed.
‫The output kind of looks like this.
‫It'll give you blues, greens, yellows, reds, all that
‫stuff. It's a configuration checker.
‫It's not scanning for viruses, or vulnerabilities,
‫or anything like that. It's scanning your configuration.
‫Did Docker get installed properly?
‫Does Docker have all the right permissions that it needs?
‫Does it have all the right kernel capabilities
‫to perform proper functionality, especially
‫around security? So, for example, if your
‫system doesn't have SELinux enabled, or AppArmor
‫enabled or installed and Docker wants to use those things,
‫it will note that stuff here.
‫Before I decide on a proper configuration
‫for servers that are going to go, you know, even just for
‫testing, not just production, I'll just run this little
‫shell script. You can run straight from the website.
‫They give you instructions here on how to run it.
‫It'll dump out a bunch of stuff.
‫It's never going to all be green.
‫Like most security tools, it's still going
‫to give you certain things.
‫You have to look through those and decide, is that OK?
‫It just kind of makes you a smarter admin.
‫Makes you aware of certain limitations, or
‫problems, with your system. You might find out that for a
‫certain Linux distribution, that's not going to work at
‫all. That particular thing is just going to have
‫to be insecure, or not a feature,
‫that kind of stuff, right.
‫It's good education. It uses a thing
‫called the CIS Docker Benchmark, which is sort of an
‫industry standard for how to make sure
‫the security of a host is properly set up for Docker.
‫And it's great. It's an easy utility to run.
‫I would run it, like if you're going to be building servers
‫with Ansible, or Puppet, or whatever you're using
‫to build servers, you would...once you've got that
‫configuration, I would deploy your servers into a mock
‫setup. You're running your configuration tool.
‫Then I would run Docker Bench against it.
‫You would get a bunch of output.
‫You could go through those, one by one, deciding, am
‫I okay with this? Can I fix it?
‫What do I got to do?
‫Should I ignore it? That kind of stuff.