CIS Docker Benchmark scanner with a score.
docker-bench-security tells you which checks passed and which didn't. It produces a raw log. It has no numeric score, no history, and no compliance mapping. Keelix runs the same checks — plus host config, port exposure, and AI-agent posture — and rolls everything into a single 0–100 posture score you can gate CI on and hand to an auditor.
What docker-bench-security gives you — and what it doesn't
docker-bench-security is a well-maintained open-source shell script. It reads your Docker daemon config, checks container runtime settings, and outputs a list of PASS, WARN, and INFO lines keyed to CIS Docker Benchmark v1.6.0 controls. For a manual one-off audit, it is useful.
But it was never designed for a continuous security workflow. Three gaps surface immediately when you try to use it in one:
No score
The CIS Docker Benchmark PDF describes a final benchmark score. docker-bench-security never implemented it. The output is a raw log: pass/warn counts with no weighted aggregate. You cannot set a numeric threshold for CI gating.
No history
Each run produces a standalone log file. There is no built-in mechanism to compare today's result against last week's, track remediation progress, or demonstrate posture improvement to a SOC 2 auditor.
No compliance mapping
The CIS check IDs in the output are not cross-referenced to SOC 2 Trust Service Criteria, ISO 27001 controls, or CIS Critical Security Controls. Producing that mapping for an audit is a manual spreadsheet exercise.
The underlying checks are not the problem. The CIS Docker Benchmark is a solid framework — it covers the daemon, container runtime, images, and host. The gap is everything around those checks: the scoring, the history, and the context.
What Keelix adds on top
Keelix runs the same class of CIS-aligned checks — daemon config, container runtime settings, image provenance, socket exposure — and then extends the audit in three directions docker-bench-security does not cover at all:
Outside-in port exposure
docker-bench-security reads config files. It does not verify what is actually reachable from the internet. Keelix's outside-in scan confirms which ports are publicly accessible — catching cases where Docker's iptables rules bypass UFW and open a port the host firewall thinks it has closed.
AI-agent and MCP posture
CIS Docker Benchmark v1.8.0 predates the AI-agent era. It has no controls for MCP server auto-approval, plaintext API keys in Claude Code or Cursor config, or the lethal trifecta. Keelix grades that surface and folds it into the same posture score.
A 0–100 score with compliance mapping
Every finding carries a severity weight. The aggregate score is a single number you can threshold in CI. Each finding maps to a CIS Docker Benchmark control, a CIS Critical Security Control, a SOC 2 Trust Service Criterion, or an ISO 27001 control — so the same scan serves the CI gate and the auditor.
Scan history and evidence export
Keelix Cloud stores each scan result. You can compare posture across deploys, track remediation over time, and export a dated, signed evidence package — formatted for a SOC 2 readiness review or an ISO 27001 evidence request.
CIS Docker Benchmark — what gets checked
The CIS Docker Benchmark v1.8.0 organizes its controls into seven sections. Keelix automates the controls in sections 1–5 that are deterministic in a compose-stack context; section 6 (Docker Security Operations) and section 7 (Docker Swarm) are flagged where applicable.
| Section | Automated by Keelix | Notes |
|---|---|---|
| 1 — Host configuration | Yes | Kernel, auditd, filesystem |
| 2 — Docker daemon configuration | Yes | TLS, logging, icc, userns |
| 3 — Daemon configuration files | Yes | File ownership + permissions |
| 4 — Container images | Partial | Non-root user, image digest; signing requires org policy |
| 5 — Container runtime | Yes | Capabilities, privilege mode, seccomp, AppArmor, resource limits |
| 6 — Docker security operations | Flagged | Process + documentation controls are manual evidence items |
| 7 — Docker Swarm | When applicable | Skipped on non-Swarm deployments |
Run CIS checks in CI — one step
Add the Keelix GitHub Action after your staging deploy. It runs the full CIS-aligned posture check, writes a report, and exits non-zero if any critical finding is present. The promote-to-production job only runs when the gate clears.
- name: Keelix CIS posture gate
uses: jakelamon/keelix@v0.1.0
with:
compose: docker-compose.yml
report: html
- name: Upload CIS report
if: always()
uses: actions/upload-artifact@v4
with:
name: keelix-cis-report
path: ${{ runner.temp }}/keelix-report.htmlThe HTML report maps each finding to its CIS Docker Benchmark control number — ready to attach to a SOC 2 evidence package. See the full GitHub Action reference for the complete inputs list including outside-in probing and delta gating.
From benchmark to compliance evidence
Most automated compliance tools — Vanta, Drata, Lacework — connect to cloud APIs. They can pull AWS Security Hub findings or check your GCP project settings. What they cannot do is scan the self-hosted VPS where your Docker stack actually runs.
Keelix fills that gap. Each CIS Docker Benchmark control in the scan report carries a mapping to the relevant SOC 2 Trust Service Criteria and ISO 27001 Annex A controls. The Cloud logbook stores a timestamped, tamper-evident record of every scan — the kind of evidence an auditor asks for when they want to see that your controls were operating continuously, not just at audit time.
See the SOC 2 evidence for Docker page for how Keelix slots into a self-hosted SOC 2 evidence workflow, and the control mapping for the full CIS → SOC 2 → ISO 27001 crosswalk.
Frequently asked
- What is the CIS Docker Benchmark?
- The CIS Docker Benchmark is a set of vendor-neutral configuration guidelines developed by the Center for Internet Security (CIS) for securely deploying Docker in production. It is organized into sections covering the host, the Docker daemon, daemon configuration files, container images, container runtime, and Docker Swarm. The current release is version 1.8.0. The benchmark is freely downloadable from cisecurity.org in PDF form; commercial automation tooling is available separately through CIS-CAT Pro. [CIS — Docker Benchmark ↗]
- What is docker-bench-security and what are its limitations?
- docker-bench-security is an open-source shell script maintained by Docker that checks your host against the CIS Docker Benchmark. It outputs PASS, WARN, INFO, and NOTE lines for each check — useful for a manual point-in-time audit. It does not produce a numeric score: a GitHub issue raised in 2017 noted that despite the CIS PDF referencing a 'final benchmark score,' the tool never implemented that output. There is no built-in scan history, no compliance mapping, and no shareable report format — the output is a raw log file. [GitHub — docker/docker-bench-security ↗]
- How is Keelix different from running docker-bench-security manually?
- docker-bench-security gives you a raw WARN/PASS log from a single point in time. Keelix gives you a 0–100 posture score that combines CIS Docker Benchmark checks with host configuration, port exposure, and AI-agent/MCP grading into a single number you can gate CI on. Each finding maps to a control (CIS, SOC 2, ISO 27001). Results are stored in Keelix Cloud so you can track posture over time, share audit-ready reports, and demonstrate improvement — not just run the check again.
- Can I use Keelix as a CIS Docker Benchmark scanner in CI?
- Yes. Add `uses: jakelamon/keelix@v0.1.0` to your GitHub Actions workflow after deploy-to-staging. The action runs the full CIS-aligned posture check on the composed stack, writes the result to a report artifact, and exits non-zero if a critical finding is present or the posture score falls below your threshold. The whole pipeline runs on-runner — no data leaves your CI environment.
- Does Keelix cover the full CIS Docker Benchmark?
- Keelix covers the CIS Docker Benchmark checks that are automatable and deterministic in a compose-stack context: daemon configuration, container runtime settings (capabilities, privilege mode, read-only filesystems, user namespaces, seccomp/AppArmor profiles), Docker socket exposure, image provenance, and host-level settings. Some CIS controls require organizational process evidence (image signing workflows, registry access policies) that are out of scope for automated scanning — Keelix flags these as manual evidence items.
Related
- GitHub Action — CIS Docker Benchmark gate in one step
- GitHub Actions compliance gate — CIS, SOC 2, and ISO checks in CI
- SOC 2 evidence for Docker — the self-hosted blind spot
- CIS → SOC 2 → ISO 27001 control mapping
- AI/MCP security — the posture surface CIS doesn't cover yet
- Pricing — the CLI is free and Apache-2.0
Run your first CIS Docker Benchmark scan in under two minutes.
Free, local-first, Apache-2.0. Scored. Mapped to controls. Nothing leaves your box.