Container security

Docker Security Audit Checklist: 39 Checks for Containers

Images, containers, volumes and the daemon socket.

6
audits
Docker
39
individual checks
named
~73s
to run the category
read-only

Containers are a good security boundary when configured carefully and almost none at all when they are not. The difference is a handful of settings that are easy to set while debugging and never revert.

  • Read-only, safe on production
  • No agent installed
  • ~73s for the category
  • 10 distros auto-detected

How much of this is serious?

Severity of all 39 Docker checks, as the scripts rate them.

  • 13High severity33%
  • 15Medium severity38%
  • 11Low severity28%

What these audits cover

  • Daemon socket exposure, docker group membership, log level and rootless mode
  • Privileged containers, the user they run as, capabilities and privilege escalation
  • Volume mount safety, permissions and ownership on bind mounts
  • Image CVEs, embedded secrets, published ports and supply-chain hygiene

What they do not cover

  • Kubernetes. Pod security, RBAC and admission control are a different surface with different tooling.
  • What your application does inside the container. These audits read container configuration, not runtime behaviour.
  • Registry access control. Who can push to your registry is not visible from the host.
The catalog

The 6 Docker audits

The daemon socket is the one to read first. Anyone who can reach it can start a privileged container that mounts the host filesystem, which is root by another name.

Daemon & Socket

Soon

Daemon socket exposure, group access, log level and rootless mode

8 checks~12s3 need root

Image Vulnerabilities

Soon

Container image CVEs, secrets, configuration and supply-chain hygiene

8 checks~16s6 need root

Volume Permissions

Soon

Docker volume mount safety, permissions and ownership

7 checks~13s7 need root

Runtime & Resources

Soon

Seccomp, AppArmor/SELinux and memory, CPU, PID and restart limits

6 checks~10s6 need root

Container Hardening

Soon

Privileged mode, user, capabilities, privilege escalation and mounts

5 checks~10s5 need root

Network & Supply Chain

Soon

Port publishing, inter-container connectivity, secrets, updates and images

5 checks~12s4 need root
Keep going

Other categories

VPS & Server7 audits45 checksDatabase6 audits37 checksWeb Server6 audits36 checks
FAQ

Docker security questions

A Docker security audit should check who can reach the daemon socket, whether containers run privileged or as root, which capabilities they hold, whether resource limits are set, how volumes are mounted and with what permissions, whether published ports are wider than they need to be, and whether the images in use carry known vulnerabilities or embedded secrets.
Because access to /var/run/docker.sock is equivalent to root on the host. Anyone who can talk to it can start a privileged container that bind-mounts the host filesystem and read or write anything on it. That applies to every member of the docker group, and to any container the socket has been mounted into, which is a common and dangerous convenience in CI setups.
Yes, because it removes a layer of defence for free. If an attacker gets code execution inside a container running as root, they start as root inside that namespace, which makes any container escape or misconfigured mount far more useful to them. Running as an unprivileged user costs a line in the Dockerfile and takes that away.
The image audit checks image hygiene and reports what it can determine from the host: image age, embedded secrets, configuration problems and supply-chain signals. For exhaustive CVE-by-CVE scanning, pair it with a dedicated scanner such as Trivy or Grype in your build pipeline, where a vulnerable image can be caught before it ever reaches a server.
Not directly. These audits read the Docker daemon and containers on a host you access over SSH. Kubernetes moves that surface into pod security standards, RBAC and admission controllers, which need their own tooling. If your workloads run on a managed cluster, this category is not the right checklist.
Audit your fleet

Run all 39 Docker checks, in one click

CtrlOps runs these audits over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals