Container compliance with dockle

Boxing Rules

Article from ADMIN 87/2025

By Chris Binnie

The open source dockle tool can help keep your Docker containers compliant.

If you work in cybersecurity, the mention of the word "compliance" invariably means that you are about to be subjected to a few hours of tedious, repetitive work. Ensuring that thousands of resources are compliant is no mean feat. These days, however, I definitely appreciate the need for systems and processes to meet external compliance frameworks and standards.

To-do lists can often help you stay organized, and this is where compliance tools come to the fore. Putting a check mark next to non-compliant resources after you have remediated them is really the only way to ensure consistent security across modern cloud or on-premise workloads and infrastructure.

In this article, I show you how to determine whether your Docker containers are compliant with the use of a fantastic open source tool called dockle [1]. The compliance standard that dockle checks against is the venerable CIS Benchmarks [2]. For good measure, dockle can also offer advice about Dockerfile linting (automatic checks of configuration files). If you need a little help constructing your Dockerfiles, you are gently reminded to look at the best practices page [3] on the Docker website.

On Your Marks

In this example, I look at installing the dockle binary file for Debian Linux derivatives (e.g., Ubuntu). As you can see in Listing 1, the VERSION variable is created to grab the latest version of the software from the dockle/releases/latest page in GitHub.

Listing 1

Installing

...

Use Express-Checkout link below to read the full article (PDF).