Docker audit fixes
Daemon & Socket: fixing all 8 checks
The daemon and socket audit reads dockerd's command line, /etc/docker/daemon.json and the docker group to establish who can reach the Docker API, which is root on the host under another name.
Only three of the eight checks talk to the daemon, so Docker Inventory, Docker Socket In Containers and Rootless Mode are the ones that skip when the audit account is neither root nor a member of the docker group. The other five read the dockerd process arguments, /etc/docker/daemon.json or getent group docker instead, so they skip only when the docker binary is missing, and the group membership check never skips at all.
Transcribed from the docker-security-daemon-socket audit script. For what the audit covers rather than how to fix it, see the Daemon & Socket checklist.
Find your finding
Listed in the order the audit runs them. Take the check name from the third field of the result line and open its page.
Docker Inventory
Baseline inventory of the Docker engine, runc version, containers and images
LowNeeds root2 resultsDocker TCP Socket
Check whether the Docker daemon is exposed over an unauthenticated TCP socket
HighNo root4 resultsDocker Socket In Containers
Check whether any running container has docker.sock mounted, granting host root
HighNeeds root3 resultsDocker Group Members
List members of the docker group, each of whom is root-equivalent via the socket
MediumNo root2 resultsDaemon Log Level
Check the Docker daemon log level to avoid sensitive data leakage via debug logs
LowNo root3 resultsRootless Mode
Check whether the Docker daemon runs in rootless mode to shrink escape blast radius
LowNeeds root3 resultsUser Namespace Remapping
Whether container root maps to an unprivileged host uid
MediumNo root3 resultsContainer Log Limits
Log driver rotation limits so container logs cannot fill the disk
LowNo root3 results
How the Daemon & Socket audit reads your server
Every check in this audit runs after the same preamble, and several of its results only make sense once you know what that preamble could and could not see.
Docker detection: DOCK=direct if docker ps works as the audit user (docker group), DOCK=root if it works through sudo; the dk helper wraps docker accordingly. IDS is the list of running container IDs and NRUN their count; dk inspect --format is used with Go templates. Podman is recognised but not audited.
A SKIP is never a pass
A skipped check verified nothing at all. The most common cause is privilege: 3 of the 8 checks in this audit need root for a complete result. Before every run, each script works out which of four privilege modes it is in.
| Mode | How it is reached | What it means for your results |
|---|---|---|
root | The audit runs as UID 0. | Every privileged branch runs directly. No check skips for lack of permission. |
nopass | sudo -n true succeeds, so the account has passwordless sudo. | Privileged commands run through sudo -n. |
pass | A sudo password was supplied in the CtrlOps audit settings and accepted. | Privileged commands run through sudo -S. |
none | None of the above worked. | CAN_ROOT=0. Every privileged branch returns SKIP with a "Need root" message rather than guessing. |
If many checks skip with a “need root” message, run the audit as root, grant the audit account sudo (with or without NOPASSWD), or supply the sudo password in the CtrlOps audit settings. For Docker checks, membership of the docker group is an alternative to sudo: run usermod -aG docker <user> and log in again.
Daemon & Socket questions
Run all 8 Daemon & Socket checks, in one click
CtrlOps runs this audit over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.
✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals