Skip to content

Commit fd5886b

Browse files
committed
Modularize resources
Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>
1 parent c5d2f4b commit fd5886b

23 files changed

+23
-2794
lines changed

content/resources/core/docker.md

Lines changed: 1 addition & 275 deletions
Original file line numberDiff line numberDiff line change
@@ -2,280 +2,6 @@
22
title = "docker resource"
33
draft = false
44

5-
platform = "linux"
6-
7-
[menu.resources]
8-
title = "docker"
9-
identifier = "resources/core/docker.md docker resource"
10-
parent = "resources/core"
115
+++
126

13-
Use the `docker` Chef InSpec audit resource to test configuration data for the Docker daemon. It's a very comprehensive resource. See also: [docker_container](/resources/core/docker_container/) and [docker_image](/resources/core/docker_image/), too.
14-
15-
## Availability
16-
17-
### Install
18-
19-
{{< readfile file="content/reusable/md/inspec_installation.md" >}}
20-
21-
### Version
22-
23-
This resource first became available in v1.21.0 of InSpec.
24-
25-
## Syntax
26-
27-
A `docker` resource block allows you to write tests for many containers:
28-
29-
```ruby
30-
describe docker.containers do
31-
its('images') { should_not include 'u12:latest' }
32-
end
33-
```
34-
35-
or:
36-
37-
```ruby
38-
describe docker.containers.where { names == 'flamboyant_allen' } do
39-
it { should be_running }
40-
end
41-
```
42-
43-
where:
44-
45-
- `.where()` may specify a specific item and value, to which the resource parameters are compared
46-
- `commands`, `ids`, `images`, `labels`, `local_volumes`, `mounts`, `names`, `networks`, `ports`, `sizes` and `status` are valid parameters for `containers`
47-
48-
The `docker` resource block also declares allows you to write test for many images:
49-
50-
```ruby
51-
describe docker.images do
52-
its('repositories') { should_not include 'insecure_image' }
53-
end
54-
```
55-
56-
or if you want to query specific images:
57-
58-
```ruby
59-
describe docker.images.where { repository == 'ubuntu' && tag == '12.04' } do
60-
it { should_not exist }
61-
end
62-
```
63-
64-
where:
65-
66-
- `.where()` may specify a specific filter and expected value, against which parameters are compared
67-
68-
## Examples
69-
70-
The following examples show how to use this Chef InSpec audit resource.
71-
72-
### Return all running containers
73-
74-
```ruby
75-
docker.containers.running?.ids.each do |id|
76-
describe docker.object(id) do
77-
its('State.Health.Status') { should eq 'healthy' }
78-
end
79-
end
80-
```
81-
82-
### Verify a Docker Server and Client version
83-
84-
```ruby
85-
describe docker.version do
86-
its('Server.Version') { should cmp >= '1.12'}
87-
its('Client.Version') { should cmp >= '1.12'}
88-
end
89-
```
90-
91-
### Iterate over all containers to verify host configuration
92-
93-
```ruby
94-
docker.containers.ids.each do |id|
95-
# call Docker inspect for a specific container id
96-
describe docker.object(id) do
97-
its(%w(HostConfig Privileged)) { should cmp false }
98-
its(%w(HostConfig Privileged)) { should_not cmp true }
99-
end
100-
end
101-
```
102-
103-
### Iterate over all images to verify the container was built without ADD instruction
104-
105-
```ruby
106-
docker.images.ids.each do |id|
107-
describe command("docker history #{id}| grep 'ADD'") do
108-
its('stdout') { should eq '' }
109-
end
110-
end
111-
```
112-
113-
### Verify that health-checks are enabled for a container
114-
115-
```ruby
116-
describe docker.object('71b5df59442b') do
117-
its(%w(Config Healthcheck)) { should_not eq nil }
118-
end
119-
```
120-
121-
## How to run the DevSec Docker baseline profile
122-
123-
You can run the `docker-baseline` profile to test Docker in two possible ways:
124-
125-
Clone the profile:
126-
127-
```sh
128-
git clone https://github.com/dev-sec/cis-docker-benchmark.git
129-
```
130-
131-
and then run:
132-
133-
```sh
134-
inspec exec cis-docker-benchmark
135-
```
136-
137-
Or execute the profile directly using a URL:
138-
139-
```sh
140-
inspec exec https://github.com/dev-sec/cis-docker-benchmark
141-
```
142-
143-
## Resource parameters
144-
145-
- `commands`, `ids`, `images`, `labels`, `local_volumes`, `mounts`, `names`, `networks`, `ports`, `sizes` and `status` are valid parameters for `containers`
146-
147-
## Resource Parameter Examples
148-
149-
### containers
150-
151-
`containers` returns information about containers as returned by [docker ps -a](https://docs.docker.com/engine/reference/commandline/ps/).
152-
153-
```ruby
154-
describe docker.containers do
155-
its('ids') { should include 'sha:71b5df59...442b' }
156-
its('commands') { should_not include '/bin/sh' }
157-
its('images') { should_not include 'u12:latest' }
158-
its('ports') { should include '0.0.0.0:1234->1234/tcp' }
159-
its('labels') { should include 'License=GPLv2' }
160-
end
161-
```
162-
163-
### object('id')
164-
165-
`object` returns low-level information about Docker objects. It's calling [docker inspect](https://docs.docker.com/engine/reference/commandline/info/) under the hood.
166-
167-
```ruby
168-
describe docker.object(id) do
169-
its('Configuration.Path') { should eq 'value' }
170-
end
171-
```
172-
173-
### images
174-
175-
`images` returns information about a Docker image as returned by [docker images](https://docs.docker.com/engine/reference/commandline/images/).
176-
177-
```ruby
178-
describe docker.images do
179-
its('ids') { should include 'sha:12b5df59...442b' }
180-
its('repositories') { should_not include 'my_image' }
181-
its('tags') { should_not include 'unwanted_tag' }
182-
its('sizes') { should_not include '1.41 GB' }
183-
end
184-
```
185-
186-
### plugins
187-
188-
`plugins` returns information about Docker plugins as returned by [docker plugin ls](https://docs.docker.com/engine/reference/commandline/plugin/).
189-
190-
```ruby
191-
describe docker.plugins do
192-
its('names') { should include ['store/weaveworks/net-plugin', 'docker4x/cloudstor'] }
193-
its('ids') { should cmp ['6ea8176de74b', '771d3ee7c7ea'] }
194-
its('versions') { should cmp ['2.3.0', '18.03.1-ce-aws1'] }
195-
its('enabled') { should cmp [true, false] }
196-
end
197-
```
198-
199-
### info
200-
201-
`info` returns the parsed result of [docker info](https://docs.docker.com/engine/reference/commandline/info/)
202-
203-
```ruby
204-
describe docker.info do
205-
its('Configuration.Path') { should eq 'value' }
206-
end
207-
```
208-
209-
### version
210-
211-
`info` returns the parsed result of [docker version](https://docs.docker.com/engine/reference/commandline/version/)
212-
213-
```ruby
214-
describe docker.version do
215-
its('Server.Version') { should cmp >= '1.12'}
216-
its('Client.Version') { should cmp >= '1.12'}
217-
end
218-
```
219-
220-
## Properties
221-
222-
- `id`
223-
- `image`
224-
- `repo`
225-
- `tag`
226-
- `ports`
227-
- `command`
228-
229-
## Property Examples
230-
231-
### id
232-
233-
```ruby
234-
describe docker_container(name: 'an-echo-server') do
235-
its('id') { should_not eq '' }
236-
end
237-
```
238-
239-
### image
240-
241-
```ruby
242-
describe docker_container(name: 'an-echo-server') do
243-
its('image') { should eq 'busybox:latest' }
244-
end
245-
```
246-
247-
### repo
248-
249-
```ruby
250-
describe docker_container(name: 'an-echo-server') do
251-
its('repo') { should eq 'busybox' }
252-
end
253-
```
254-
255-
### tag
256-
257-
```ruby
258-
describe docker_container(name: 'an-echo-server') do
259-
its('tag') { should eq 'latest' }
260-
end
261-
```
262-
263-
### ports
264-
265-
```ruby
266-
describe docker_container(name: 'an-echo-server') do
267-
its('ports') { should eq '0.0.0.0:1234->1234/tcp' }
268-
end
269-
```
270-
271-
### command
272-
273-
```ruby
274-
describe docker_container(name: 'an-echo-server') do
275-
its('command') { should eq 'nc -ll -p 1234 -e /bin/cat' }
276-
end
277-
```
278-
279-
## Matchers
280-
281-
{{< readfile file="content/reusable/md/inspec_matchers_link.md" >}}
7+
{{< readfile file="content/reusable/md/modularized_resource.md" >}}

0 commit comments

Comments
 (0)