On a Linux Docker host, the least-surprising audit is the official Docker Bench script: clone the Docker Bench for Security repository, enter it, and run sudo sh docker-bench-security.sh. Preserve both the text and JSON logs, record the Engine and benchmark versions, then assign each warning or failure to the host, daemon, runtime, image, or operations owner before changing production settings.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
What Docker Bench for Security actually audits
Docker Bench for Security is Docker’s open-source, CIS-aligned configuration audit script. Docker describes it as “a script that checks for dozens of common best-practices around deploying Docker containers in production.” Its automated tests are based on the CIS Docker Benchmark v1.6.0, a community-consensus set of secure-configuration recommendations.
As an Amazon Associate I earn from qualifying purchases.
The benchmark is organized around three practical scopes:
- Host: operating-system configuration and host-level controls that affect Docker’s security boundary.
- Docker daemon: how the Engine is configured, exposed, authenticated, and integrated with the host.
- Container runtime: how running containers are configured and what privileges, isolation, and access they receive.
That scope matters when you triage a report. A daemon setting belongs with the Docker platform owner; a host audit rule belongs with the operating-system team; a risky container setting may require the runtime or application team. Bench is an assessment of secure configuration at scan time, not a vulnerability scanner.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare the host and define the audit record
Use a supported target
Run the host-script form on the Linux machine whose Docker installation you want to assess. Docker Bench requires Docker 1.13.0 or later. The script needs root privileges for checks that read protected host files, inspect daemon settings, or examine audit configuration, so the normal invocation uses sudo.
The repository says jq is optional but recommended. Install it through your distribution’s normal package process if you want convenient inspection of the JSON log; the audit itself can still run without it.
Recommended Free Tools
Capture context before the first scan
Store the following alongside every report:
- Docker Engine version.
- Linux distribution and release.
- Docker Bench repository revision or release you used.
- Scan date and time.
- Whether you ran the host script or a containerized form.
- Checks excluded, exceptions accepted, and the person or team approving each exception.
Without this context, a later difference may reflect a changed benchmark or operating system rather than a real security improvement. Keep the text and JSON output together in the same evidence record and protect them according to your organization’s audit-retention policy.
Know the audit-interface dependency
Some checks use auditctl. If the distribution does not provide that command, Docker Bench checks /etc/audit/audit.rules instead. A missing command therefore does not automatically mean that the control is irrelevant; read the test’s output to determine which evidence path was evaluated.
Run the baseline host audit
The host script avoids adding a privileged audit container, while still requiring root access for host checks. Run it from a working directory that you can preserve as evidence.
- Clone the official repository.
git clone https://github.com/docker/docker-bench-security.git - Enter the checkout.
cd docker-bench-security - Run all available checks with root privileges.
sudo sh docker-bench-security.sh - Preserve both generated logs. Keep the operator-readable text output and the JSON output, and attach the context listed above.
The default run executes all available CIS tests. Let the command finish unless you have a documented reason to stop it; partial output is difficult to compare with a later full scan.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Use a clean, repeatable checkout
Pin the repository revision used by a compliance cycle rather than silently pulling a different revision for every host. When you deliberately update the benchmark, record the change as a new baseline and review whether added or changed checks explain new findings. Do not compare a current report with an older one without noting the benchmark and Engine versions.
Select or exclude checks deliberately
Targeted runs are useful for troubleshooting, change validation, and evidence collection, but they should not replace a complete baseline. Docker Bench documents these selectors:
- Run one check:
sh docker-bench-security.sh -c check_2_2 - Exclude one check:
sh docker-bench-security.sh -e check_2_2 - Run an area while excluding one check:
sh docker-bench-security.sh -c container_images -e check_4_5
Check identifiers use forms such as check_2_6. Community checks use check_c_<number>. Keep a machine-readable list of every selector and exclusion with the report. An exclusion is an explanation of audit scope, not evidence that the underlying condition is secure.
When a focused run is appropriate
- Re-run one control after changing a daemon setting.
- Collect evidence for a specific compliance control without waiting for a full scan.
- Investigate a failure whose remediation depends on a host package or audit rule.
- Verify that an approved exception still matches the intended condition.
After a focused run, perform another full scan before declaring the host remediated. A change that fixes one control can affect another control or the availability of a workload.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand the report before changing anything
PASS, WARN, and FAIL are different decisions
| Result | What it means | What to do next |
|---|---|---|
| PASS | The tested condition matched the benchmark rule at scan time. | Keep the evidence and monitor for configuration drift. |
| WARN or FAIL | The observed condition needs review against the test’s stated remediation. | Confirm applicability, identify the owner, test the change, and document an exception if you cannot remediate. |
Read the remediation text attached to the individual finding. A warning is not automatically proof of an exploitable vulnerability, and a pass does not prove that the host is free of vulnerabilities. The benchmark evaluates specific configuration conditions; it does not discover every software defect or attack path.
Use both output formats
The text log is designed for an operator reading the test and its remediation notes. The JSON log is better for structured evidence, ticket creation, trend analysis, and compliance-system ingestion. Preserve the original files rather than copying only a score or a list of failures, because the surrounding command output provides the context needed to reproduce a decision.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Assign each finding to the right owner
- Host owner: operating-system permissions, services, audit configuration, and host files.
- Docker daemon owner: Engine configuration, daemon exposure, authentication, and authorization-related settings.
- Runtime or platform owner: container privileges, isolation, namespaces, capabilities, and runtime defaults.
- Image or application owner: image configuration and container contents that influence runtime checks.
- Operations owner: logging, monitoring, change control, exception expiry, and evidence retention.
This assignment prevents the report from becoming an undifferentiated security score that nobody owns.
Remediate safely and verify the result
Start with applicability, not with a blind command
For every WARN or FAIL, read the benchmark condition and remediation, then confirm that it applies to the host’s role. A development workstation, a single-purpose production node, and a multi-tenant platform may require different approved exceptions. If a control conflicts with a documented operational requirement, record the requirement and compensating safeguards instead of editing the host until the workload breaks.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTest changes outside production first
Validate hardening in staging or an equivalent maintenance process. Changes can affect availability, logging, networking, storage, image workflows, and the ability of operators to troubleshoot containers. Include a rollback plan and a test that exercises the workloads most dependent on the setting.
Re-run the exact control, then the full baseline
- Apply the approved change in the test environment.
- Run the relevant selector, such as
-c check_2_2, to obtain quick feedback. - Exercise the workload and its operational tooling.
- Run
sudo sh docker-bench-security.shagain for the complete host baseline. - Compare the new text and JSON evidence with the prior record, including exclusions and versions.
A focused pass confirms one condition; the full pass confirms that the broader configuration remains consistent.
Containerized execution: convenient, but highly privileged
Docker also publishes a containerized way to run the benchmark. It is convenient for repeatable deployment, but it is not an unprivileged inspection container. The documented form uses:
--net host, giving the audit container the host network namespace.--pid host, exposing host processes through the host PID namespace.--userns host, disabling a separate user-namespace boundary for the audit container.--cap-add audit_control, adding the capability needed for audit-related checks.- Read-only mounts for host paths and Docker binaries.
- A read-only bind of
/var/run/docker.sock.
These settings let the benchmark inspect the running host, but they also increase the container’s blast radius. A read-only Docker socket is still powerful: access to the daemon API can expose extensive information and management operations. Review every namespace, capability, mount, and image source before starting the container, and use only an image your organization approves and can pin to a known version.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Why host paths matter
The published instructions include mounts for host files and Docker binaries because many checks need to inspect the host rather than the container’s filesystem. Paths must be adjusted for the operating system. A command copied from a Linux host should not be assumed to work unchanged elsewhere.
Docker Desktop caveat
Docker Desktop on macOS does not expose the same systemd and binary paths as a native Linux Docker host. A containerized benchmark may therefore lack the evidence expected by Linux-specific checks, and a result from the Desktop VM should not be presented as an audit of a separate production Linux machine. Establish exactly which host is being assessed before interpreting the report.
When the container form is justified
- Your platform standardizes approved benchmark images and pins their versions.
- You need repeatable execution in a controlled compliance job.
- The job’s security review accepts host namespaces, audit capability, and Docker-socket access.
- You can collect logs without granting the container unnecessary write access.
If those conditions are not met, the host-script method is usually easier to reason about because it does not add another highly privileged container to the host.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Host script versus containerized execution
| Decision axis | Host script | Containerized form |
|---|---|---|
| Privilege and blast radius | Uses root on the host; no additional audit container. | Uses host network, PID, and user namespaces, an audit capability, host mounts, and Docker-socket access. |
| Deployment | Clone the repository and run the shell script. | Pull and run an approved image with host-specific mounts and flags. |
| Host-specific evidence | Reads the target host directly. | Depends on correctly mounted paths, binaries, and host interfaces. |
| Repeatability | Requires pinning the repository checkout and documenting the host environment. | Can be standardized by pinning the image and its benchmark version. |
| Evidence collection | Text and JSON output are produced in the working environment. | Requires an intentional log-export path that does not add unnecessary write access. |
Neither form removes the need to review findings. The choice is an operational and threat-model decision, not a claim that one execution mode makes the host secure by itself.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Turn one scan into a recurring control
A one-time manual scan is useful for a baseline, but recurring compliance automation must answer additional questions:
- Schedule: How often will each production host be scanned, and what event triggers an out-of-cycle scan?
- Version pinning: Which repository revision or image and which CIS benchmark revision define the control?
- Evidence: Where are the original text and JSON logs stored, and how long are they retained?
- Exceptions: Who approves an exclusion, what compensating control exists, and when does the exception expire?
- Ownership: Which team receives each finding, and what service-level target governs remediation?
- Change correlation: Can a new finding be associated with an Engine upgrade, host rebuild, image change, or policy update?
Keep the complete output even when an integration extracts only PASS, WARN, and FAIL counts. Structured automation is valuable for routing and trend detection, while the text remediation remains useful to the engineer making the change.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshoot common audit problems
The command fails before checks run
- Confirm that you are in the cloned repository directory.
- Confirm that the host has Docker 1.13.0 or later.
- Re-run with
sudoand verify that the invoking account is allowed to use it. - Check that the repository checkout is complete and that the script is readable.
An audit check reports missing audit tooling
Determine whether the distribution provides auditctl. If it does not, inspect the test’s output to see whether Docker Bench evaluated /etc/audit/audit.rules. Treat the result as evidence about the path that was checked, not as permission to ignore the control.
The containerized form cannot find a file or service
Compare every host mount and binary path with the target operating system. Linux systemd paths and Docker binaries may not exist in the same location on another distribution, and Docker Desktop on macOS exposes a different architecture. Correct the approved invocation or use the host script rather than weakening isolation further.
A finding is not applicable to this host
Document why the control does not apply, identify the approving owner, record any compensating measure, and use the documented exclusion selector only when the exception is authorized. Keep the check in the full benchmark record so later reviewers can distinguish an approved exception from an omitted test.
A remediation fixes one result but breaks a workload
Roll back through the approved process, reproduce the impact in staging, and involve the host, daemon, runtime, and application owners as appropriate. Reassess the benchmark remediation and any compensating controls rather than repeatedly applying an untested setting to production.
What Docker Bench does not replace
Docker Bench is a secure-configuration assessment. It is not a vulnerability scanner, patch-management system, image-security review, secrets-management program, runtime-detection platform, or incident-response plan. A host can pass every tested condition while running an unpatched Engine, a vulnerable base image, an exposed application, or a leaked credential.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the report as one control in a broader program:
- Patch the operating system, Docker Engine, and dependencies through the normal change process.
- Review images for vulnerabilities, unnecessary packages, unsafe defaults, and provenance.
- Protect secrets outside images and source repositories, and rotate them when exposure is suspected.
- Monitor runtime behavior and collect logs in a way that supports detection and investigation.
- Maintain incident-response procedures that do not depend on a benchmark report being available.
The benchmark’s value is precision: it tells you whether specific configuration conditions matched a published CIS rule at a particular time.
Production audit runbook
- Identify the exact Linux Docker host and its workload owner.
- Record the Engine version, distribution, date, benchmark revision, and execution mode.
- Clone the approved repository and run
sudo sh docker-bench-security.sh. - Preserve the text and JSON logs as immutable evidence under your retention policy.
- Review every PASS, WARN, and FAIL in its host, daemon, or runtime scope.
- Assign each actionable item to the host, daemon, runtime, image, or operations owner.
- Test remediation in staging or an equivalent maintenance process, including rollback.
- Use a focused selector to verify the change, then perform a complete baseline scan.
- Document authorized exclusions, compensating controls, and expiry dates.
- Schedule recurring scans with pinned versions and centralized evidence collection.
Following this sequence turns Docker Bench from a one-off shell command into a defensible configuration-audit process: reproducible execution, interpretable findings, controlled remediation, and evidence that remains meaningful when the host or benchmark changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
