docker-baseline-auditor

Read-only Docker security baseline checker. Zero dependencies beyond a working docker CLI on the host you run it on. Checks for privileged mode, host network/PID/IPC namespace sharing, Docker socket mounted into a container, containers running as root, missing memory limits/restart policies, :latest tag usage, disabled AppArmor/Seccomp, and added Linux capabilities. Read-only: runs docker ps / docker inspect only, never modifies containers, no network calls, no data leaves the host. Free, pay-what-you-want. Part of the Errant Solutions spare-capacity tools series (see also sshd-hardening-auditor, tls-cert-watchdog, cert-transparency-watcher).

Homepage Download