# docker/docker-bench-security architecture

> Architecture diagram of the GitHub repository docker/docker-bench-security, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/docker/docker-bench-security
- Repository: https://github.com/docker/docker-bench-security

## Overview

Docker Bench for Security is a command-line utility that assesses a Docker host and its containers against CIS benchmark practices. An operator invokes the script, optionally selects or excludes checks, and receives benchmark findings and log files. The checks span host configuration, Docker daemon settings and files, images, runtime, security operations, Swarm, and Docker Enterprise; community checks are also available. The README documents these capabilities and outputs, but no source excerpts were provided, so internal call relationships and helper-layer responsibilities cannot be verified.

Main entry points: [`docker-bench-security.sh`](https://github.com/docker/docker-bench-security/blob/master/docker-bench-security.sh) (Bench CLI), [`functions/output_lib.sh`](https://github.com/docker/docker-bench-security/blob/master/functions/output_lib.sh) (Findings and Logs), [`tests/1_host_configuration.sh`](https://github.com/docker/docker-bench-security/blob/master/tests/1_host_configuration.sh) (Host Configuration), [`tests/2_docker_daemon_configuration.sh`](https://github.com/docker/docker-bench-security/blob/master/tests/2_docker_daemon_configuration.sh) (Daemon Configuration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_run["Invocation"]
  node_bench["Bench CLI"]
  node_selection["Check Selection"]
end

subgraph group_cis["CIS Checks"]
  node_host["Host Configuration"]
  node_daemon["Daemon Configuration"]
  node_daemonfiles["Daemon Config Files"]
  node_images["Container Images"]
  node_runtime["Container Runtime"]
  node_operations["Security Operations"]
  node_swarm["Swarm Configuration"]
  node_enterprise["Enterprise Configuration"]
  node_community["Community Checks"]
end

subgraph group_results["Results"]
  node_output["Findings and Logs<br/>[output_lib.sh]"]
  node_logfile["Log Files"]
end

node_operator(("Operator"))

node_operator -->|"invokes"| node_bench
node_bench -->|"accepts options"| node_selection
node_bench -->|"runs checks"| node_host
node_bench -->|"runs checks"| node_daemon
node_bench -->|"runs checks"| node_daemonfiles
node_bench -->|"runs checks"| node_images
node_bench -->|"runs checks"| node_runtime
node_bench -->|"runs checks"| node_operations
node_bench -->|"runs checks"| node_swarm
node_bench -->|"runs checks"| node_enterprise
node_bench -->|"runs checks"| node_community
node_bench -->|"produces results"| node_output
node_output -->|"writes logs"| node_logfile

click node_bench "https://github.com/docker/docker-bench-security/blob/master/docker-bench-security.sh"
click node_selection "https://github.com/docker/docker-bench-security/blob/master/docker-bench-security.sh"
click node_host "https://github.com/docker/docker-bench-security/blob/master/tests/1_host_configuration.sh"
click node_daemon "https://github.com/docker/docker-bench-security/blob/master/tests/2_docker_daemon_configuration.sh"
click node_daemonfiles "https://github.com/docker/docker-bench-security/blob/master/tests/3_docker_daemon_configuration_files.sh"
click node_images "https://github.com/docker/docker-bench-security/blob/master/tests/4_container_images.sh"
click node_runtime "https://github.com/docker/docker-bench-security/blob/master/tests/5_container_runtime.sh"
click node_operations "https://github.com/docker/docker-bench-security/blob/master/tests/6_docker_security_operations.sh"
click node_swarm "https://github.com/docker/docker-bench-security/blob/master/tests/7_docker_swarm_configuration.sh"
click node_enterprise "https://github.com/docker/docker-bench-security/blob/master/tests/8_docker_enterprise_configuration.sh"
click node_community "https://github.com/docker/docker-bench-security/blob/master/tests/99_community_checks.sh"
click node_output "https://github.com/docker/docker-bench-security/blob/master/functions/output_lib.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_bench,node_selection toneBlue
class node_host,node_daemon,node_daemonfiles,node_images,node_runtime,node_operations,node_swarm,node_enterprise,node_community toneAmber
class node_output,node_logfile toneMint
class node_operator toneIndigo
```

## Components

### Invocation

- [Bench CLI](https://github.com/docker/docker-bench-security/blob/master/docker-bench-security.sh): `docker-bench-security.sh`
- [Check Selection](https://github.com/docker/docker-bench-security/blob/master/docker-bench-security.sh): `docker-bench-security.sh`

### CIS Checks

- [Host Configuration](https://github.com/docker/docker-bench-security/blob/master/tests/1_host_configuration.sh): `tests/1_host_configuration.sh`
- [Daemon Configuration](https://github.com/docker/docker-bench-security/blob/master/tests/2_docker_daemon_configuration.sh): `tests/2_docker_daemon_configuration.sh`
- [Daemon Config Files](https://github.com/docker/docker-bench-security/blob/master/tests/3_docker_daemon_configuration_files.sh): `tests/3_docker_daemon_configuration_files.sh`
- [Container Images](https://github.com/docker/docker-bench-security/blob/master/tests/4_container_images.sh): `tests/4_container_images.sh`
- [Container Runtime](https://github.com/docker/docker-bench-security/blob/master/tests/5_container_runtime.sh): `tests/5_container_runtime.sh`
- [Security Operations](https://github.com/docker/docker-bench-security/blob/master/tests/6_docker_security_operations.sh): `tests/6_docker_security_operations.sh`
- [Swarm Configuration](https://github.com/docker/docker-bench-security/blob/master/tests/7_docker_swarm_configuration.sh): `tests/7_docker_swarm_configuration.sh`
- [Enterprise Configuration](https://github.com/docker/docker-bench-security/blob/master/tests/8_docker_enterprise_configuration.sh): `tests/8_docker_enterprise_configuration.sh`
- [Community Checks](https://github.com/docker/docker-bench-security/blob/master/tests/99_community_checks.sh): `tests/99_community_checks.sh`

### Results

- [Findings and Logs](https://github.com/docker/docker-bench-security/blob/master/functions/output_lib.sh): `functions/output_lib.sh`
- **Log Files**

### Other components

- **Operator**

## Connections

- Operator → Bench CLI: invokes (evidence: `README.md`)
- Bench CLI → Check Selection: accepts options (evidence: `README.md`)
- Bench CLI → Host Configuration: runs checks (evidence: `README.md`)
- Bench CLI → Daemon Configuration: runs checks (evidence: `README.md`)
- Bench CLI → Daemon Config Files: runs checks (evidence: `README.md`)
- Bench CLI → Container Images: runs checks (evidence: `README.md`)
- Bench CLI → Container Runtime: runs checks (evidence: `README.md`)
- Bench CLI → Security Operations: runs checks (evidence: `README.md`)
- Bench CLI → Swarm Configuration: runs checks (evidence: `README.md`)
- Bench CLI → Enterprise Configuration: runs checks (evidence: `README.md`)
- Bench CLI → Community Checks: runs checks (evidence: `README.md`)
- Bench CLI → Findings and Logs: produces results (evidence: `README.md`)
- Findings and Logs → Log Files: writes logs (evidence: `README.md`)