I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image.

I am trying to ascertain whether the concept of CIS hardening applies to the container itself or just the host OS where the container is running. (I am not interested in the host itself as that is already CIS hardened by the hosting provider)

Had a couple of suggestions such as https://github.com/docker/docker-bench-security and https://github.com/dev-sec/cis-docker-benchmark but these again only seem to apply to the Host OS where docker is running. the nginx alpine image does for example contain some sample confs and html which should be removed according to CIS hardening rules.

Are there any scripts or tools i can run that can report on whether there are other aspects of the container that need to be hardened in the Dockerfile to ensure the container is CIS compliant? ideally i'd like to avoid having to prove every point in the CIS hardening spec manually. I have found this but its 3 years old script and i cant be confident that its maintained.

1 Answer 1


The CIS Docker benchmark primarily relates to the configuration of the Docker engine instance that you're running. There are some checks relating to running containers however

The area of the benchmark you want for this is Section 4. Container Images and Build File. Most of the recommendations in there would apply to your case of building an image, 4.5 might not as that's more a engine level setting.

what I would say is that many of the recommendations in that area (things like only installing required packages) can't really be checked automatically (as what's required varies for case to case) so it's more of a case of reviewing the Dockerfile and built image manually, for that sort of thing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .