git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
docker build --no-cache -t docker-bench-security .
docker run -it --net host --pid host --cap-add audit_control \
    -v /var/lib:/var/lib \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v /usr/lib/systemd:/usr/lib/systemd \
    -v /etc:/etc --label docker_bench_security \

returns a report including:

[NOTE] 1.2  - Ensure the container host has been Hardened

Some containers run on Virtual Machines, how to harden these machines to ensure that the container host is hardened?

  • 2
    Hardening a container host is going to be OS specific and the measures taken are also going to depend on the environment and what services/functionality needs to be available to the container. – Daisetsu Mar 17 '19 at 21:13

That's a generic recommendation to make use of Operating system hardening tools applicable to the underlying host.

I'd recommend reviewing the CIS benchmark for whatever host OS you're running in your virtual machines. Compliance with the areas of those benchmarks that meet your use case/threat model, should provide a good starting point there.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.