{"id":18995540,"url":"https://github.com/turbot/steampipe-mod-docker-compliance","last_synced_at":"2026-01-26T13:05:41.395Z","repository":{"id":184249897,"uuid":"670896919","full_name":"turbot/steampipe-mod-docker-compliance","owner":"turbot","description":"Run individual controls or full compliance benchmarks for Docker resources and more across all of your Docker containers using Powerpipe and Steampipe.","archived":false,"fork":false,"pushed_at":"2025-08-14T06:10:59.000Z","size":2213,"stargazers_count":3,"open_issues_count":3,"forks_count":0,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-08-14T08:29:42.185Z","etag":null,"topics":["cis","compliance","docker","docker-api","exec","hacktoberfest","powerpipe","powerpipe-mod","security","sql","steampipe","steampipe-mod"],"latest_commit_sha":null,"homepage":"https://hub.powerpipe.io/mods/turbot/docker_compliance","language":"Pascal","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/turbot.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-26T04:57:59.000Z","updated_at":"2025-08-14T06:11:03.000Z","dependencies_parsed_at":"2024-11-08T17:34:05.053Z","dependency_job_id":"e796b140-4a4d-4f98-8aba-7766bdbb2dbd","html_url":"https://github.com/turbot/steampipe-mod-docker-compliance","commit_stats":null,"previous_names":["turbot/steampipe-mod-docker-compliance"],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/turbot/steampipe-mod-docker-compliance","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/turbot%2Fsteampipe-mod-docker-compliance","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/turbot%2Fsteampipe-mod-docker-compliance/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/turbot%2Fsteampipe-mod-docker-compliance/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/turbot%2Fsteampipe-mod-docker-compliance/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/turbot","download_url":"https://codeload.github.com/turbot/steampipe-mod-docker-compliance/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/turbot%2Fsteampipe-mod-docker-compliance/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28778770,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-26T11:46:04.308Z","status":"ssl_error","status_checked_at":"2026-01-26T11:46:02.664Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cis","compliance","docker","docker-api","exec","hacktoberfest","powerpipe","powerpipe-mod","security","sql","steampipe","steampipe-mod"],"created_at":"2024-11-08T17:31:28.503Z","updated_at":"2026-01-26T13:05:41.379Z","avatar_url":"https://github.com/turbot.png","language":"Pascal","funding_links":[],"categories":["Pascal"],"sub_categories":[],"readme":"# Docker Compliance Mod for Powerpipe\n\n34+ checks covering industry defined security best practices for Docker. Includes full support for `CIS v1.6.0` compliance benchmarks across all your Docker resources.\n\n**Includes full support for the CIS v1.6 Docker Benchmarks**.\n\nRun checks in a dashboard:\n![image](https://raw.githubusercontent.com/turbot/steampipe-mod-docker-compliance/main/docs/docker_cis_v160_dashboard.png)\n\nOr in a terminal:\n![image](https://raw.githubusercontent.com/turbot/steampipe-mod-docker-compliance/main/docs/docker_cis_v160_console.png)\n\n## Documentation\n\n- **[Benchmarks and controls →](https://hub.powerpipe.io/mods/turbot/docker_compliance/controls)**\n- **[Named queries →](https://hub.powerpipe.io/mods/turbot/docker_compliance/queries)**\n\n## Getting Started\n\n### Installation\n\nInstall Powerpipe (https://powerpipe.io/downloads), or use Brew:\n\n```sh\nbrew install turbot/tap/powerpipe\n```\n\nThis mod also requires [Steampipe](https://steampipe.io) with the [Docker plugin](https://hub.steampipe.io/plugins/turbot/docker) and the [Exec plugin](https://hub.steampipe.io/plugins/turbot/exec) as the data source. Install Steampipe (https://steampipe.io/downloads), or use Brew:\n\nInstall the Docker and Exec plugins with [Steampipe](https://steampipe.io):\n\n```sh\nbrew install turbot/tap/steampipe\nsteampipe plugin install docker\nsteampipe plugin install exec\n```\n\nSteampipe will automatically use your default Docker credentials.\n\nFinally, install the mod:\n\n```sh\nmkdir dashboards\ncd dashboards\npowerpipe mod init\npowerpipe mod install github.com/turbot/steampipe-mod-docker-compliance\n```\n\n### Browsing Dashboards\n\nStart Steampipe as the data source:\n\n```sh\nsteampipe service start\n```\n\nStart the dashboard server:\n\n```sh\npowerpipe server\n```\n\nBrowse and view your dashboards at **http://localhost:9033**.\n\n### Running Checks in Your Terminal\n\nInstead of running benchmarks in a dashboard, you can also run them within your\nterminal with the `powerpipe benchmark` command:\n\nList available benchmarks:\n\n```sh\npowerpipe benchmark list\n```\n\nRun a benchmark:\n\n```sh\npowerpipe benchmark run docker_compliance.benchmark.cis_v160_5\n```\n\nDifferent output formats are also available, for more information please see\n[Output Formats](https://powerpipe.io/docs/reference/cli/benchmark#output-formats).\n\n## Configuration\n\nThis mod uses the credentials configured in the [Steampipe Docker plugin](https://hub.steampipe.io/plugins/turbot/docker) and the [Steampipe Exec plugin](https://hub.steampipe.io/plugins/turbot/exec). Please see below for examples on how to configure connections for these plugins.\n\n### Local connections\n\nWhen connecting to Docker on your local host, the Docker and Exec plugin connections require basic configuration:\n\n```hcl\nconnection \"docker_local\" {\n  plugin  = \"docker\"\n}\n\nconnection \"exec_local\" {\n  plugin  = \"exec\"\n}\n```\n\n### Remote connections\n\n#### Docker without TLS enabled\n\nNote: It is not recommended to allow insecure connections. Please see [Protect the Docker daemon socket](https://docs.docker.com/engine/security/protect-access/#use-tls-https-to-protect-the-docker-daemon-socket) for instructions on setting up TLS.\n\nYou only need to specify the `host`:\n\n```hcl\nconnection \"docker_remote\" {\n  plugin = \"docker\"\n  host   = \"tcp://12.345.67.890:2375\"\n}\n```\n\nTo connect to the remote host, you need to provide additional details in the Exec plugin connection, including the private key:\n\n```hcl\nconnection \"exec_remote\" {\n  plugin      = \"exec\"\n  host        = \"12.345.67.890\"\n  user        = \"ec2-user\"\n  protocol    = \"ssh\"\n  private_key = \"/Users/myuser/keys/key.pem\"\n}\n```\n\n#### Docker with TLS enabled\n\nIf Docker does have TLS enabled, you will need to set `tls_verify` and provide a path to the directory containing your certificates and key files:\n\n```hcl\nconnection \"docker_remote_tls\" {\n  plugin     = \"docker\"\n  host       = \"tcp://12.345.67.890:2376\"\n  tls_verify = true\n  cert_path  = \"/Users/myuser/certs\"\n}\n```\n\nThe Exec plugin connection does not require any different configuration:\n\n```hcl\nconnection \"exec_remote\" {\n  plugin      = \"exec\"\n  host        = \"12.345.67.890\"\n  user        = \"ec2-user\"\n  protocol    = \"ssh\"\n  private_key = \"/Users/myuser/keys/key.pem\"\n}\n```\n\n### Using workspaces with multiple connections\n\nIf you have multiple local and/or remote Docker and Exec connections, you can use [Steampipe workspaces](https://steampipe.io/docs/reference/config-files/workspace) to manage your Steampipe environments. Workspaces are profiles that are usually defined in `~/.steampipe/config/workspaces.spc`.\n\nFor instance, if multiple Docker and Exec plugin connections were configured:\n\n```hcl\nconnection \"docker_local\" {\n  plugin  = \"docker\"\n}\n\nconnection \"docker_remote_tls\" {\n  plugin     = \"docker\"\n  host       = \"tcp://12.345.67.890:2376\"\n  tls_verify = true\n  cert_path  = \"/Users/myuser/certs\"\n}\n```\n\n```hcl\nconnection \"exec_local\" {\n  plugin  = \"exec\"\n}\n\nconnection \"exec_remote\" {\n  plugin      = \"exec\"\n  host        = \"12.345.67.890\"\n  user        = \"ec2-user\"\n  protocol    = \"ssh\"\n  private_key = \"/Users/myuser/keys/key.pem\"\n}\n```\n\nYou can create multiple workspaces in `~/.steampipe/config/workspaces.spc`:\n\n```hcl\nworkspace \"docker_exec_local\" {\n  search_path_prefix = \"docker_local,exec_local\"\n}\n\nworkspace \"docker_exec_remote\" {\n  search_path_prefix = \"docker_remote_tls,exec_remote\"\n}\n```\n\nTo switch between workspaces, you can use the `--workspace` argument:\n\n```sh\npowerpipe benchmark run cis_v160 --workspace docker_exec_local\npowerpipe benchmark run cis_v160 --workspace docker_exec_remote\n```\n\nAdditional argments can be set in each workspace, including cache TTL, mod location, and more. Please see [Workspace Arguments](https://steampipe.io/docs/reference/config-files/workspace#workspace-arguments) for a full list.\n\n## Setting control types\n\nThe Docker Compliance mod queries use the Docker and Exec plugin tables in order to retrieve information about the Docker Engine and the host it runs on. If you do not have access to connect to either of those, you can set the `benchmark_plugins` variable to decide which controls are included in benchmarks.\n\nBy default, both Docker and Exec queries are included:\n\n```hcl\nbenchmark_plugins = [\"docker\", \"exec\"]\n```\n\nTo only execute queries using Docker plugin tables, create `powerpipe.ppvars` with the following value:\n\n```hcl\nbenchmark_plugins = [\"docker\"]\n```\n\nNote that controls can always be run directly, even if `benchmark_plugins` does not include the plugin type. For instance:\n\n```hcl\npowerpipe control run cis_v160_5\n```\n\nThis variable can be overwritten in several ways:\n\n- Copy and rename the `powerpipe.ppvars.example` file to `powerpipe.ppvars`, and then modify the variable values inside that file\n- Pass in a value on the command line:\n\n  ```sh\n  powerpipe benchmark run cis_v160 --var 'benchmark_plugins=[\"docker\"]'\n  ```\n- Set an environment variable:\n\n  ```sh\n  SP_VAR_benchmark_plugins='[\"exec\"]' powerpipe benchmark run cis_v160\n  ```\n\n## Open Source \u0026 Contributing\n\nThis repository is published under the [Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0). Please see our [code of conduct](https://github.com/turbot/.github/blob/main/CODE_OF_CONDUCT.md). We look forward to collaborating with you!\n\n[Steampipe](https://steampipe.io) and [Powerpipe](https://powerpipe.io) are products produced from this open source software, exclusively by [Turbot HQ, Inc](https://turbot.com). They are distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our [Open Source FAQ](https://turbot.com/open-source).\n\n## Get Involved\n\n**[Join #powerpipe on Slack →](https://turbot.com/community/join)**\n\nWant to help but don't know where to start? Pick up one of the `help wanted` issues:\n\n- [Powerpipe](https://github.com/turbot/powerpipe/labels/help%20wanted)\n- [Docker Compliance Mod](https://github.com/turbot/steampipe-mod-docker-compliance/labels/help%20wanted)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fturbot%2Fsteampipe-mod-docker-compliance","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fturbot%2Fsteampipe-mod-docker-compliance","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fturbot%2Fsteampipe-mod-docker-compliance/lists"}