Project: Chef InSpec (Provisioning / Security & Compliance)
File: docker.md

+++ title = "docker resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "docker" identifier = "inspec/resources/os/docker.md docker resource" parent = "inspec/resources/os" +++ Use the `docker` Chef InSpec audit resource to test configuration data for the Docker daemon. It is a very comprehensive resource. See also: and , too. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.21.0 of InSpec. A `docker` resource block allows you to write tests for many containers: describe docker.containers do its('images') { should_not include 'u12:latest' } end or: describe docker.containers.where { names == 'flamboyant_allen' } do it { should be_running } end where `.where()` may specify a specific item and value, to which the resource parameters are compared `commands`, `ids`, `images`, `labels`, `local_volumes`, `mounts`, `names`, `networks`, `ports`, `sizes` and `status` are valid parameters for `containers` The `docker` resource block also declares allows you to write test for many images: describe docker.images do its('repositories') { shouldnot include 'insecureimage' } end or if you want to query specific images: describe docker.images.where { repository == 'ubuntu' && tag == '12.04' } do it { should_not exist } end where `.where()` may specify a specific filter and expected value, against which parameters are compared The following examples show how to use this Chef InSpec audit resource. docker.containers.running?.ids.each do |id| describe docker.object(id) do its('State.Health.Status') { should eq 'healthy' } end end describe docker.version do its('Server.Version') { should cmp >= '1.12'} its('Client.Version') { should cmp >= '1.12'} end docker.containers.ids.each do |id| describe docker.object(id) do its(%w(HostConfig Privileged)) { should cmp false } its(%w(HostConfig Privileged)) { should_not cmp true } end end docker.images.ids.each do |id| describe command("docker history #{id}| grep 'ADD'") do its('stdout') { should eq '' } end end describe

do its(%w(Config Healthcheck)) { should_not eq nil } end There are two ways to run the `docker-baseline` profile to test Docker via the `docker` resource. Clone the profile: git clone https://github.com/dev-sec/cis-docker-benchmark.git and then run: inspec exec cis-docker-benchmark Or execute the profile directly via URL: inspec exec https://github.com/dev-sec/cis-docker-benchmark `commands`, `ids`, `images`, `labels`, `local_volumes`, `mounts`, `names`, `networks`, `ports`, `sizes` and `status` are valid parameters for `containers` `containers` returns information about containers as returned by . describe docker.containers do its('ids') { should include 'sha:71b5df59...442b' } its('commands') { should_not include '/bin/sh' } its('images') { should_not include 'u12:latest' } its('ports') { should include '0.0.0.0:1234->1234/tcp' } its('labels') { should include 'License=GPLv2' } end `object` returns low-level information about Docker objects. It is calling under the hood. describe docker.object(id) do its('Configuration.Path') { should eq 'value' } end `images` returns information about a Docker image as returned by . describe docker.images do its('ids') { should include 'sha:12b5df59...442b' } its('repositories') { shouldnot include 'myimage' } its('tags') { shouldnot include 'unwantedtag' } its('sizes') { should_not include '1.41 GB' } end `plugins` returns information about Docker plugins as returned by . describe docker.plugins do its('names') { should include ['store/weaveworks/net-plugin', 'docker4x/cloudstor'] } its('ids') { should cmp ['6ea8176de74b', '771d3ee7c7ea'] } its('versions') { should cmp ['2.3.0', '18.03.1-ce-aws1'] } its('enabled') { should cmp [true, false] } end `info` returns the parsed result of describe docker.info do its('Configuration.Path') { should eq 'value' } end `info` returns the parsed result of describe docker.version do its('Server.Version') { should cmp >= '1.12'} its('Client.Version') { should cmp >= '1.12'} end `id` `image` `repo` `tag` `ports` `command` describe docker_container(name: 'an-echo-server') do its('id') { should_not eq '' } end describe docker_container(name: 'an-echo-server') do its('image') { should eq 'busybox:latest' } end describe docker_container(name: 'an-echo-server') do its('repo') { should eq 'busybox' } end describe docker_container(name: 'an-echo-server') do its('tag') { should eq 'latest' } end describe docker_container(name: 'an-echo-server') do its('ports') { should eq '0.0.0.0:1234->1234/tcp' } end describe docker_container(name: 'an-echo-server') do its('command') { should eq 'nc -ll -p 1234 -e /bin/cat' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}