Docker audit fixes

Daemon & Socket: fixing all 8 checks

The daemon and socket audit reads dockerd's command line, /etc/docker/daemon.json and the docker group to establish who can reach the Docker API, which is root on the host under another name.

Only three of the eight checks talk to the daemon, so Docker Inventory, Docker Socket In Containers and Rootless Mode are the ones that skip when the audit account is neither root nor a member of the docker group. The other five read the dockerd process arguments, /etc/docker/daemon.json or getent group docker instead, so they skip only when the docker binary is missing, and the group membership check never skips at all.

8
checks in this audit
2
rated high severity
3
need root or sudo
~12s
automated run time

Transcribed from the docker-security-daemon-socket audit script.

Every check

Find your finding

Listed in the order the audit runs them. Take the check name from the third field of the result line and open its page.

  • Docker Inventory

    Soon

    Baseline inventory of the Docker engine, runc version, containers and images

    LowNeeds root2 results

  • Docker TCP Socket

    Soon

    Check whether the Docker daemon is exposed over an unauthenticated TCP socket

    HighNo root4 results

  • Docker Socket In Containers

    Soon

    Check whether any running container has docker.sock mounted, granting host root

    HighNeeds root3 results

  • Docker Group Members

    Soon

    List members of the docker group, each of whom is root-equivalent via the socket

    MediumNo root2 results

  • Daemon Log Level

    Soon

    Check the Docker daemon log level to avoid sensitive data leakage via debug logs

    LowNo root3 results

  • Rootless Mode

    Soon

    Check whether the Docker daemon runs in rootless mode to shrink escape blast radius

    LowNeeds root3 results

  • User Namespace Remapping

    Soon

    Whether container root maps to an unprivileged host uid

    MediumNo root3 results

  • Container Log Limits

    Soon

    Log driver rotation limits so container logs cannot fill the disk

    LowNo root3 results
Shared script behaviour

How the Daemon & Socket audit reads your server

Every check in this audit runs after the same preamble, and several of its results only make sense once you know what that preamble could and could not see.

Docker detection: DOCK=direct if docker ps works as the audit user (docker group), DOCK=root if it works through sudo; the dk helper wraps docker accordingly. IDS is the list of running container IDs and NRUN their count; dk inspect --format is used with Go templates. Podman is recognised but not audited.

Why checks skip

A SKIP is never a pass

A skipped check verified nothing at all. The most common cause is privilege: 3 of the 8 checks in this audit need root for a complete result. Before every run, each script works out which of four privilege modes it is in.

The four privilege modes an audit script can run in, and what each one means for checks that need root
ModeHow it is reachedWhat it means for your results
rootThe audit runs as UID 0.Every privileged branch runs directly. No check skips for lack of permission.
nopasssudo -n true succeeds, so the account has passwordless sudo.Privileged commands run through sudo -n.
passA sudo password was supplied in the CtrlOps audit settings and accepted.Privileged commands run through sudo -S.
noneNone of the above worked.CAN_ROOT=0. Every privileged branch returns SKIP with a "Need root" message rather than guessing.

If many checks skip with a “need root” message, run the audit as root, grant the audit account sudo (with or without NOPASSWD), or supply the sudo password in the CtrlOps audit settings. For Docker checks, membership of the docker group is an alternative to sudo: run usermod -aG docker <user> and log in again.

Keep going

Related audits

FAQ

Daemon & Socket questions

Because only some of them ask it anything. The script sets DOCK=direct when docker ps works as the audit user, DOCK=root when it works through sudo, and leaves it empty otherwise, and Docker Inventory, Docker Socket In Containers and Rootless Mode all short-circuit to SKIP on an empty DOCK. The remaining checks read the dockerd process arguments and /etc/docker/daemon.json, which need no daemon connection at all. Add the audit account to the docker group or run the audit as root and those three fill in.
It combines three independent signals and any one of them is enough: a listener whose address ends in :2375 or :2376 from ss -tln, a -H tcp:// argument on the running dockerd command line, and a tcp:// entry in the "hosts" array of /etc/docker/daemon.json. A daemon configured for TCP but not currently listening is therefore still reported. The port number alone then decides severity, so 2376 is a WARN on the assumption that TLS is in use and anything else is a FAIL; the check never confirms that --tlsverify and client certificates are actually enforced.
Not without a maintenance window. Enabling userns-remap moves images and containers under /var/lib/docker/<uid>.<gid>, so everything you already have disappears from docker ps and docker images until it is pulled and recreated, and root-owned files on bind mounts become unreadable inside the container. Workloads that need --pid=host, --net=host or --privileged have to opt out with --userns=host. Prove it on a staging host before touching production.
Audit your fleet

Run all 8 Daemon & Socket checks, in one click

CtrlOps runs this audit over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals