vamp-docker-audit

Overview

vamp-docker-audit is a CIS Docker Benchmark-aligned security auditor that inspects running Docker containers, their environment variables, images, networks, and volumes for misconfigurations and credential exposure. It operates entirely through the Docker CLI — no SDK dependency — making it portable across any Docker-capable host. A multi-phase architecture covers daemon access verification, per-container security checks, secret detection in environment variables, image freshness, and network driver analysis, with findings rated CRITICAL to INFO and exported to Console, JSON, or HTML.

Features

• Phase 0: daemon access verification and Docker socket permission check (/var/run/docker.sock ownership and mode)
• Container checks (DOCK-001 to DOCK-010): privileged mode (CRITICAL), dangerous Linux capabilities including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_PTRACE (HIGH), root user inside container (MEDIUM), Docker socket mounted inside container (CRITICAL), host network mode (HIGH), sensitive bind mounts (/etc, /var/run, /proc, /sys, /root, /home) (MEDIUM), host PID namespace (HIGH), host IPC namespace (MEDIUM), unlimited restart policy (INFO), ports bound to 0.0.0.0 (LOW)
• Environment variable secret scanning: variable names matching PASSWORD, PASSWD, SECRET, TOKEN, KEY, API_KEY, APIKEY, PRIVATE, CREDENTIALS, AUTH, DSN (HIGH); value patterns for sk_/pk_, ghp_, glpat-, xox[bpoa]-, Bearer, AKIA..., ey..., base64-encoded blobs (HIGH); connection string variables DATABASE_URL, MONGO_URL, REDIS_URL and variants (MEDIUM)
• Image checks: :latest or <none> tag (LOW), images older than 90 days (INFO)
• Network analysis: host-driver network inventory (INFO)
• Volume inventory (INFO)
• Selective container targeting with --containers (comma-separated names or IDs) or full-fleet scan
• Stopped container inclusion with --include-stopped
• ENV scan bypass with --no-env-scan for privacy-sensitive environments
• Custom Docker socket path via --socket
• Export to Console (Rich per-container panels), JSON, and HTML (dark-theme)

Requirements

• Python 3.9 or later
• rich >= 13.7.0
• Docker CLI in PATH and a running Docker daemon
• Optional: fpdf2 >= 2.7 for --report-pdf

Installation

pip install vamp-docker-audit
# o con Homebrew:
brew install vampsecure-labs/labs/vamp-docker-audit

git clone https://github.com/belky-me/vamp-docker-audit.git
cd vamp-docker-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

python3 vamp_docker_audit.py --help

usage: vamp_docker_audit.py [-h]
                             [--socket PATH]
                             [--containers NAMES]
                             [--include-stopped]
                             [--no-env-scan]
                             [--json FILE] [--html FILE]
                             [--client CLIENT] [--engagement ENGAGEMENT]
                             [--auditor AUDITOR] [--report-scope SCOPE]
                             [--report-html FILE] [--report-pdf FILE]

vamp-docker-audit — Docker Security Auditor (VampSecure Labs)

Examples

# Audit all running containers on the local host
python3 vamp_docker_audit.py

# Audit specific containers by name
python3 vamp_docker_audit.py --containers web,api,db

# Include stopped containers in the audit
python3 vamp_docker_audit.py --include-stopped

# Audit without ENV variable secret scanning
python3 vamp_docker_audit.py --no-env-scan

# Use a non-standard Docker socket (e.g. rootless Docker)
python3 vamp_docker_audit.py --socket /run/user/1000/docker.sock

# Export findings to JSON and HTML
python3 vamp_docker_audit.py --json results.json --html report.html

# Generate client-ready engagement report (HTML + PDF)
python3 vamp_docker_audit.py \
    --client "Acme Corp" --engagement "Container Security Review Q3 2026" \
    --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf

CLI Reference

Output Formats

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-docker-audit is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/belky-me
• Orchestrator: github.com/belky-me/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division

Versión

v1.3 — VampSecure Labs Security Research Division