Docker Integration with DefectDojo

Docker Integration with DefectDojo

DefectDojo works with two Docker security tools. Docker Bench for Security (docker-bench-security) is an open source shell script published in Docker's GitHub organization that checks a Docker host, its daemon configuration, and its running containers against the CIS Docker Benchmark, and writes results to a log file and a JSON file. Docker Scout is Docker's image analysis service, which builds an inventory of the packages in container images, matches them against vulnerability data, and evaluates images against policies. DefectDojo imports Docker Bench JSON as a file, and DefectDojo Pro pulls Docker Scout posture through an API connector.

Docker Integration with DefectDojo

We use Docker tooling at two layers. Docker Bench tells us whether the hosts running our containers are configured the way the CIS benchmark expects, and Docker Scout tells us how exposed the images in each environment are. Neither is useful as a report nobody reopens. Sending Docker Bench results and Docker Scout posture into DefectDojo puts host hardening gaps and image risk on the Asset that owns each environment, where they get owners, SLA dates, and a history we can show an auditor.

Why Docker Matters

Containers are only as safe as the host they run on and the images they are built from, and the two need different checks.

• Docker Bench covers the host side: daemon flags, file permissions on Docker configuration, logging and auditing, and runtime settings of containers such as privileged mode or shared namespaces.
• Its checks map to numbered CIS Docker Benchmark recommendations, which gives auditors a standard reference.
• Docker Scout covers the image side and reports vulnerability counts and policy compliance per environment.
• Run on their own, both produce point-in-time output. A host that drifts back into a bad configuration looks the same as one that was never fixed.

Advantages of This Integration

What we gained by routing Docker results through DefectDojo:

• Stable identity for each check. Docker Bench findings are deduplicated on the CIS check ID (for example 2.1), so rerunning the script on the same host updates the same findings instead of creating new ones.
• Drift shows up on reimport. Reimporting each run into the same Test mitigates checks that now pass and reactivates checks that regressed.
• Severity that reflects the result. FAIL results arrive as Critical and automated WARN results as High, so SLA rules separate real misconfigurations from informational notes.
• Remediation text attached. Each Docker Bench finding carries the benchmark's remediation and its expected impact, so the engineer fixing it doesn't need the PDF.
• Image posture next to host posture (DefectDojo Pro). The Docker Scout connector adds per-environment vulnerability and policy findings to the same Assets as host hardening and other scanners.

How This Integration Works

Docker Bench for Security: file import. DefectDojo imports the script's JSON output with the docker-bench-security Scan scan type.

1. Run the script on the Docker host. With -l, it writes a log to the path you give and a matching .json file next to it:

git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
sudo sh docker-bench-security.sh -l /var/log/docker-bench/prod-host-01.log

2. Import the .json file. In the UI, open the Engagement, choose Import Scan Results, select docker-bench-security Scan, and upload it. To automate, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=docker-bench-security Scan" \
  -F "file=@prod-host-01.log.json" \
  -F "product_name=container-platform" \
  -F "engagement_name=CIS Benchmark prod-host-01" \
  -F "deduplication_on_engagement=true" \
  -F "auto_create_context=true"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "docker-bench-security Scan" \
  --report-path "./prod-host-01.log.json" \
  --product-name "container-platform" \
  --engagement-name "CIS Benchmark prod-host-01" \
  --auto-create-context

3. Reimport each later run for that host into the same Test with /api/v2/reimport-scan/.

Docker Scout: connector (DefectDojo Pro). The Docker Scout connector reads the Docker Scout metrics exporter API. You need a Docker personal access token created by an owner of a Docker organization that is enrolled in Docker Scout, because the metrics exporter is an organization-level feature. In the connector, enter https://api.scout.docker.com as the Location, the token as the Secret, and your Docker organization namespace. You can also set a Minimum Severity. DefectDojo creates a Record for each Docker Scout stream (your runtime environments) and imports one finding per severity level summarizing the vulnerabilities Docker Scout counts in that stream, plus a finding for each image that fails your Docker Scout policy.

Data Granularity: What Gets Imported

The table covers the docker-bench-security Scan parser.

Docker Scout findings from the connector are summaries, not per-CVE records. Docker Scout's metrics API reports aggregate counts per stream, so open the stream in Docker Scout for per-image and per-CVE detail.

Use Cases

Hardening a container platform: A platform team runs Docker Bench across its build agents and production hosts, with one Engagement per host. DefectDojo shows which hosts still fail Critical checks, and which fixes held after the next run.

Preparing for a CIS-based audit: Because each finding is titled with its CIS check number and carries the benchmark's remediation text, the team can export open benchmark failures by host and show how long each one stayed open.

Watching image risk by environment (DefectDojo Pro): The Docker Scout connector imports a severity summary and policy failures for each stream, so a security lead can see whether production images carry more Critical vulnerabilities this month than last, alongside host findings for the same environment.

After a configuration change: When an engineer changes daemon flags or logging settings, the next Docker Bench reimport shows exactly which checks moved from failing to passing.

Operational Tips

• Keep one Test per host and reimport into it. The check ID is the deduplication key, and deduplication normally runs across the whole Asset, so the same failing check on a second host would be flagged as a duplicate of the first. Give each host its own Engagement and import with deduplication_on_engagement=true, or its own Asset.
• Tag each import with the host name (for example tags=prod-host-01) so findings can be filtered by host in reports.
• Manual checks are skipped unless they FAIL. If your auditors expect evidence for manual recommendations, track those outside the import.
• INFO results become Low and NOTE results become Info. Set minimum_severity=Medium on import if you only want FAIL and WARN results to drive work.
• Run the script with the same options each time. Excluding or including checks with -e or -c changes which findings appear, and reimport will treat missing checks as fixed.
• Risk-accept benchmark recommendations that don't apply to your environment, with a reason and an expiry, instead of deleting the findings.