%
% FH Technikum Wien
% !TEX encoding = UTF-8 Unicode
%
% Erstellung von Master- und Bachelorarbeiten an der FH Technikum Wien mit Hilfe von LaTeX und der Klasse TWBOOK
%
% Um ein eigenes Dokument zu erstellen, müssen Sie folgendes ergänzen:
% 1) Mit \documentclass[..] einstellen
%    * Master- oder Bachelorarbeit
%    * Studiengang
%    * Sprache (english, german, ngerman)
%    * Zitationsstandard (Harvard, IEEE) (Standard: IEEE)
%    * Biber oder BibTeX als Literaturbackend (Biber, BibTeX) (Standard: Biber)
% 2) Deckblatt, Kurzfassung, etc. ausfüllen
% 3) und die Arbeit schreiben (die verwendeten Literaturquellen in Literatur.bib eintragen)
%
% Getestet mit TeXstudio mit Zeichenkodierung utf-8 (=ansinew/latin1) und TexLive unter Ubuntu
% Zu beachten ist, dass die Kodierung der Datei mit der Kodierung des paketes inputenc zusammen passt!
% Die Kodierung der Datei twbook.cls MUSS ANSI betragen!
% Bei der Verwendung von UTF8 muss nicht nur die Kodierung des Dokuments auf UTF8 gestellt sein, sondern auch die des BibTex-Files!
%
% Bugreports und Feedback bitte per E-Mail an latex@technikum-wien.at
%
% Version V2.24 von 2024-12-19 otrebski
%
\documentclass[BIF,Bachelor,english,IEEE]{twbook}%\documentclass[Bachelor,BMR,ngerman]{twbook}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{todonotes}

%% Definieren Sie hier weitere Literaturdatenbanken
%\addbibresource{Literaturdatenbank.bib}

\usepackage[newfloat]{minted}
\usepackage{caption}

\graphicspath{./img}

\newenvironment{code}{\captionsetup{type=listing}}{}
\SetupFloatingEnvironment{listing}{}
\usepackage{chngcntr}
\counterwithin{listing}{section}

% Die nachfolgenden Pakete stellen sonst nicht benötigte Features zur Verfügung
\usepackage{blindtext}

%
% Einträge für Deckblatt, Kurzfassung, etc.
%
\title{Hardening Hybrid Infrastructures:\\Security Approaches for Docker Containers and their Host Systems}
\author{Benedikt Galbavy}
\studentnumber{2210257082}
%\author{Titel Vorname Name, Titel\and{}Titel Vorname Name, Titel}
%\studentnumber{XXXXXXXXXXXXXXX\and{}XXXXXXXXXXXXXXX}
\supervisor{Dipl. Ing. Manuel-Christopher Parg, BSc.}
%\supervisor[Begutachter]{Titel Vorname Name, Titel}
%\supervisor[Begutachterin]{Titel Vorname Name, Titel}
%\secondsupervisor{Titel Vorname Name, Titel}
%\secondsupervisor[Begutachter]{Titel Vorname Name, Titel}
%\secondsupervisor[Begutachterinnen]{Titel Vorname Name, Titel}
\place{Wien}
%\kurzfassung{\blindtext}
%\schlagworte{Schlagwort1, Schlagwort2, Schlagwort3, Schlagwort4}
\outline{\blindtext}
\keywords{Docker, Containerization, Hybrid, Security}
%\acknowledgements{\blindtext}

\begin{document}

\maketitle

%
% .. und hier beginnt die eigentliche Arbeit. Viel Erfolg beim Verfassen!
%
\chapter{Containerization}

Containerization is more relevant today than ever. Modern software design patterns like microsservices rely heavily on using multiple isolated components---something that would not be possible with traditional hardware-based systems, or at least unfeasibly expensive; this is especially relevant for development and testing environments, which require reproducible and lightweight setups. DevOps pipelines often use containerization to run tasks on demand, ranging from unit tests to artifact building, and are prevalent in many software control systems---for example in the form of GitHub Actions or GitLab CI. Compared to earlier approaches of virtual machines, containers allow running similarly independent systems with less overhead and less start-up delay, primarily due to not simulating the hardware and kernel, but only isolating user space. And these points are only amplified by the wide-spread adoption through major tech companies and cloud platforms, which spent time and money on improving the software and surrounding tooling \cite{finley_2014_amazon}\cite{tozzi_2018_5}, as well as expanding on the original idea through concepts like orchestration of larger, distributed systems \cite{kubernetes_2023_overview}.

\section{A Solution to Dependencies}

Especially in development, dependencies are a well known problem in non-standard environments; different software requires different versions of the same libraries, often resulting in conflicts. This can be caused by installing the latest version of a given dependency at some point, but not updating it---commonly known as the ``it works on my machine'' problem \cite{pardo_2023_but}\cite{wang_2025_common}. One such scenario of a dependency conflict is python, which often removes functions even in minor versions \cite{a2024_whats}, thus leading to incompatibilities---which are expressed as run-time errors in the case of python specifically, making them harder to detect. Containerization solves that problem by virtualizing encapsulated, standardized environments; Docker is one of the most widely adopted containerization tools \cite{a2025_leading}, and will thus be used as a stand-in for containerization for the purposes of this thesis. There is some functionality specific to docker, which have been highlighted \autoref{cha:discussion}; overall these differences are very minor however, and for most purposes alternative tools like Podman fulfill the role equally well.

\section{A Duplication of Dependencies}

As each container is a separate system, this introduces redundancy, particularly in background services and system-level dependencies rather than application libraries. While Docker does not duplicate the kernel or even the hardware to the same level a full virtual machine does \cite{docker_2023_what}, each container still contains a complete operating system---although it usually does not feature a full desktop environment, but only a minimal user space---especially with minimal distributions like Alpine Linux. Furthermore there is commonly a larger dependency overlap in most modern software\todo{quote?}: Static elements like glibc and language interpreters mostly contribute to storage redundancy, but have a minimal performance impact. In contrast, service dependencies---including logging daemons, databases, and schedulers---consume CPU time, memory, and I/O resources. Considering similar services are often run on the same machine, such as two web services as shown in \autoref{sec:use_case_small_scale_web_services}, these dependencies are often similar or identical. One notable example is databases---which are commonly provided as standalone containers \cite{zhao_2024_simplifying}, instead of being shipped with the image. While this separation can be convenient, this can lead to multiple instances of the same container on one host.

\section{A Solution to Duplication}

While much research has already explored reducing storage inefficiencies in docker images \cite{skourtis_2019_carving}, a less explored area is the duplication of service dependencies across containers. Many systems run multiple instances of the same service---message queues, databases, caching systems, authentication and redirection proxies, and logging systems are all common examples, despite their potential for centralization. While not all of these services can be reused, identifying the ones that are practical to share offers opportunities for less overhead and tighter integration with the host system. Logging in particular is a promising candidate, as not only is it essential for most systems, but docker already captures container output streams. Instead of routing them to a new container or service, they can be processed centrally on the host, reducing duplication and simplifying management.

\section{Sharing Resources---To the Wrong Audience}

One of the core premises of containerization is isolation---each container acting independently with limited access to other containers or the host system. The previous sections focused on breaking this isolation for the purposes of resource efficiency. This brings the obvious trade-off of increasing the attack surface. There has been a great deal of research on attacks such as container escapes \cite{putta_2023_enhancing}\cite{yasrab_2018_mitigating}\cite{yasrab_2018_mitigating}, and consequences of such an attack increase dramatically when resources are shared between the containers. While docker networks secure inter-container communication \cite{a2024_networking}\cite{docker}, this does not secure interaction between the container and host system, and does not prevent containers from accessing host resources, especially if they have been deliberately exposed. A prominent example of such an attack is the Log4Shell exploit \cite{zhaojun_2021_cve202144228}---which allowed remote code execution through logging---assuming similar exploits could exist in other logging software, just a single crafted log message could be enough to turn a single compromised container into a wider breach.

These risks highlight the importance of considering security implications when services are reused for a hybrid environment---a challenge addressed in the following chapters.

\chapter{Constructing a Real World Scenario}

Since the focus of this thesis is on identifying improvements and analyzing trade-offs between isolation and efficiency of real world applications, a realistic scenario is required. The constructed environment requires interfaces---HTTP(S), SSH, persistent volumes, background services---similar to those found in a production environment, while still keeping it minimal to ensure accuracy of any implementations. There are countless scenarios that fulfill these criteria, but one of the most common are web services.

\section{Use-Case: Small Scale Web Services}\label{sec:use_case_small_scale_web_services}

In an enterprise context, redundancies can often be planned for and eliminated in advance, but in smaller scale scenarios, be it smaller companies, or even just personal projects, environments often grow organically by adding additional services reactively to changing requirements rather than planning long term---leading to unplanned duplication. Such systems also often use docker compose \cite{kamath_2021_containerize} or similar orchestration tools with convenience focused configurations---containing less moving parts and are easier to update---instead of favoring optimization. However these scenarios also have the highest incentive to stay cost effective.

\subsection{The pieces of the puzzle}

\begin{figure}[!htbp]
\centering
\includegraphics[width=0.7\linewidth]{webservice-use_case.png}
\caption{Network diagram of a docker setup with Gitea and Bitwarden}\label{fig:webservice}
\end{figure}

\subsubsection{Gitea---A Wide Attack Surface}

Gitea serves as an example for any git server. It will be used due to its lightweight design, but is otherwise representative of enterprise grade systems like GitLab. A git server provides a wide attack surface \cite{gitea}\cite{gitlab} due to the mix of different user content through file storage, comments and issues, and CI pipelines, and a mix of interfaces with HTTP(S) access and SSH access---commonly via a user ‘git’. SSH access in particular requires careful configuration \cite{gasser_2014_a}, as the host needs to access an SSH server inside the container, something rarely done otherwise. Gitea requires a database for storing user submissions---which can be an integrated SQLite3 instance, but more commonly is a postgres database container, and it requires a file volume, commonly mounted directly to the host; it furthermore has optional dependencies in code runners for pipelines, and an email server.

\subsubsection{Bitwarden---Increasing the Stakes}

Bitwarden, or more accurately vaultwarden---an open source implementation of a bitwarden server---serves a less complex component, but stores highly sensitive data. Unlike Gitea, it only requires a database and optionally an email server, but this raises the question of how big of a security risk is introduced by sharing a core service like a database between two services differing greatly in risk. Vaultwarden in particular provides great value to such an analysis due to its thorough documentation \cite{danigarcia_2025}, allowing purposeful misconfiguration to test different attack vectors.

\subsubsection{NGinX---The Entrypoint}

Reverse proxies like NGinX or Traefik are commonly used as an entry point to route incoming requests \cite{wahanani_2021_implementation} to the correct services based on hostname. Compared to Traefik, NGinX also provides a significant amount of additional functionality, however an extended feature set can also introduce unnecessary complexity, increasing the risk of misconfigurations---this has to be analysed in the following chapters. It is also important to point out that oftentimes a firewall is even before the proxy, or integrated into it; examples include iptables rules on the host, or fail2ban integrated with the nginx logs.

\subsubsection{Background Service Redundancy}\label{ssub:background_service_redundancy}

Additionally to the primary services, there are some background services required, which affect both Gitea and Bitwarden:

For TLS/SSL, certificates are required---which are commonly handled by a Let’s Encrypt ``certbot''. The service can either run on the host directly, or in its own container; either way the certificates will need to be exported to the NGinX container---in most cases the certificate service will write to a shared volume. However due to rate limits on issuing certificates, and the rapid testing required for this thesis, automatic certificate management has been eliminated as part of the tested setup.

As previously touched upon, most scenarios include some form of log management and processing. Docker already provides prerequisites, and allows configuring log collection to a file, to journald, or to log drivers of common log management systems\todo{quote docker page of log drivers}. However since this is already integrated into docker itself, and does not need additional configurations of the docker services, analysing it would be beyond the scope of this thesis.

It should be noted, that the applications themselves are not the focus of the analysis, but just serve as means to an end; the focus is in the analysis of the dependencies.

\subsection{Reducing redundancy}

\begin{figure}[!htbp]
\centering
\includegraphics[width=0.7\linewidth]{webservice-hybrid.png}{}
\caption{Network diagram of \autoref{fig:webservice} with a shared Postgres service}\label{fig:webservice-hybrid}
\end{figure}

\autoref{fig:webservice-hybrid} illustrates two services running on a shared host system, rather than deploying a separate instance for each service. Initially the logging system was considered as a candidate for demonstrating a hybrid setup. However, since docker already manages logging---including support for external logging systems, as discussed in \autoref{ssub:background_service_redundancy}---this approach would neither be novel nor yield any measureable difference to the baseline. Disabling Docker's built-in logging systems would introduce an arbitrary change not reflective of real-world scenarios. As a resuilt the focus now lies on replacing the two database containers with a shared service on the host. This change is expected to produce more meaningful differences in a practical scenario.

\subsection{The caveats of the setup}

Even in a comparatively simple scenario such as the one described in this chapter, conflicts and  may arise between the services---and even Docker itself. By default, all Docker containers are connected to the \texttt{docker0} network interface, which uses the subnet \texttt{172.17.0.0/16}\todo{cite: docker documentation}. An exception to this rule is Docker Compose, which creates a separate network for each Compose file. To alleviate this issue, a network must be defined in the Docker Compose file, and the corresponding subnet must be allowed in the PostgreSQL configuration\todo{cite: docker compose docs}.

\chapter{Reproducibility}

Since the docker host system will also be tested, it also needs to be reproducible---to achieve that it will be instantiated as a virtual machine. Since the term ‘host’ often has different meanings, especially in a context of containerization, this section will clarify the terms used for the rest of the thesis:
The device on which the VM is hosted will henceforth be called VM-host; the host of the Docker containers---the described VM---will be called docker host, docker VM, or just host. To allow reliable reproduction of attacks, these will also be made from a VM, which will be called the client-vm, or just client. If any further services are required, which would normally be external ``on the internet'', a third vm will be used, the ``external-vm''. The VM-host will only ever be used for configuring the VMs, never to test anything. The base configuration can be found in \autoref{appendix_base_config}.

\section{The Host of the Host}

Tools have been selected based on reproducibility and compatibility, but not performance. The resulting stack---Vagrant, VirtualBox, Ansible, Ubuntu---is widely adopted \cite{a2024_vagrant} and well supported, allowing better reuse of existing research, as well as sharing of the test setup.

\begin{figure}[!htbp]
\centering
\includegraphics[width=0.7\linewidth]{attack_lab.png}
\caption{Relation of the components in the lab setup using a simplified representation of the tested services}\label{fig:lab}
\end{figure}

\section{Tooling for the VM-Host}

\todo{possible vagrant explanation}

\section{Preparing for Attack}

To evaluate the effectiveness of base configuration and the implemented measures, a series of controlled attacks are performed from the client VM against the running services in the docker host. At first Ubuntu Desktop was considered as the OS, however as the client VM is not the focus of this thesis and thus does not need to be representative of the real world to the same degree as the docker VM, Kali Linux was determined to be a better option due to the suite of preinstalled tooling for the simulated attacks.

To evaluate the effectiveness of base configuration and the implemented measures, a series of controlled attacks are performed from the client VM against the running services in the docker host. The process is split into three phases, mirroring real world scenarios:
\begin{itemize}
\item Reconnaissance: Tools like nmap, netcat and curl are used to discover any open ports, services, and misconfigurations.
\item Exploitation: Metasploit and custom scripts are used to test the effectiveness of known exploits on a specific configuration. Due to the reproducibility of the environment, effectiveness can be measured and compared as a simple pass/fail rate.
\item Post-Exploitation: After gaining access, tools like linpeas and manual inspecting are used to determine access to shared resources.
\end{itemize}

The goal in these tests is not to discover novel exploits, but to simulate real world attack paths and analyse the additional risk introduced by the hybrid architecture. It should also be noted, that some tested measures only protect against a specific step, or assumes certain prerequisites---some steps will thus be skipped where applicable.

\section{Entrypoints}\label{sec:entrypoints}

While for most attacks the entry point will be the same as for regular usage---in most cases via the exposed HTTP(S) port---such attacks are limited to surface weaknesses. It is however realistic to expect attackers to gain access in some form, through misconfigurations, issues introduced in the further up the software supply chain, or in extrem cases even through zero-day exploits; thus it is prudent to adopt ``assume breach'' mindset for setups as described in this thesis \cite{souppaya_2017_application} \cite{avrahami_2019_breaking}---for the purposes of testing the configurations, an assumed breach will be provided via a docker container\todo{How will access be simulated?}.

\chapter{The Holes in the Wall}

This chapter describes the tests against the architecture. Each test starts with the configuration described in \autoref{appendix_base_config}, with the corresponding changes as described in \autoref{appendix_patches} applied via patch\cite{patch1}. Assuming a complete configuration, the VMs are booted with vagrant\cite{hashicorp_vagrant}.

\section{Security analysis---Use-Case: Web Services}

\subsection{Base Configuration}

The base configuration is minimal, relying on default values wherever possible.

\subsubsection*{Reconnaissance}

\paragraph*{NMap Scan}

As shown in \autoref{log:base:nmap_sS}, although no unexpected ports are open, the scan does reveal that the setup redirects to Gitea by default, instead of Bitwarden or a blank page. This is behavior is expected, as no alternative default has been configured.

\paragraph*{Known services analysis}

The HTTP headers of the nginx entrypoint (\autoref{log:base:curl_I}) show a redirect and reveal the Nginx version; following the redirect of the Gitea service (\autoref{log:base:curl_IL_gitea}) does not bring any new information. The body of this request (\autoref{log:base:curl_L_gitea}) forms the landing page of Gitea, and does not directly expose any critical data. However, it does reveal the installations version number, which paired with known security vulnerabilities \cite{gitea} could pose a security risk. It also reveals the address \texttt{http://localhost:3000/} in a \texttt{<meta>} tag, though it is unclear if this reflects an active configuration or a visual misconfiguration. However, base64 encoded manifest includes the same address, implying it is indeed used internally.

Vaultwarden presents a similar issue (\autoref{log:base:curl_L_bitwarden}) with regard to its version after allowing the page to execute JavaScript, albeit with a more complex set of HTTP headers (\autoref{log:base:curl_IL_bitwarden}).

\subsubsection*{Exploitation}

As the goal of this exercise is not to find novel exploits, and preliminary scans do not reveal any known vulnerabilities, it needs to be assumed the configuration is moderately safe as is. For multilayered security it is essential to test more components than just the external interface\todo{cite paper about this approach}. To simulate internal access, the container described in \autoref{sec:entrypoints} is used, as demonstrated in \autoref{log:base:metasploit:ssh_login}. Similar scans, as described before, confirm the presence of an open port 3000, as shown in \autoref{log:base:vuln:nmap}, but do not reveal any additional services.

\subsubsection*{Post-Exploitation}

In a typical Docker Compose setup, Docker networks already provide strong encapsulation\todo{cite the paper about Docker network security}. As such the database for either service could not be accessed. The only successful container access was establishing direct communication with other public-facing services, effectively bypassing any potential firewall. However, this can again be alleviate by using a separate bridge network between each service and the Nginx container.

\subsection{Hybrid configuration}

\subsection{Outdated versions of services}

[TODO: Gitea 1.17.2]

\chapter{Discussion - NAME PENDING}\label{cha:discussion}

Introduction/Summary

\section{Untested Configurations}

Due to the wide array of possible configurations for any docker setup, is it virtually impossible to cover all in detail. Nonetheless this section will try to highlight some more common configurations, which were left out, and reason on why they were not tested. It is important to note that this list is by no means a complete list in any form.

\subsection{Alternatives to Docker Networks}

While it is common to expose specific ports for services---such as 3000 for NODE.js and thus Gitea, or variations on 8080 (8081, 8090, \textellipsis) for HTTP services---this approach is prone to cause port collisions. To avoid this, it is common to use a docker network \cite{a2024_networking} instead, especially as docker compose already defines the name of each service as its hostname. As docker networks are also a common security measure \cite{yasrab_2018_mitigating}, using hostnames not only improves convenience---both, in terms of setup and usage---but also security---thus testing configurations without using docker networks would not provide any meaningful results.

\subsection{Hardening of services}

The security of both services in the tested setup can be further improved by implementing the suggested hardening measures according to their documentations\todo{cite hardening page gitea and bitwarden}---some of which are implemented for other tests anyway---extensively testing security of the services in itself would however go past the scope of this thesis, as the selected services are merely a representation of a possible scenario.

% Hier können Sie Ihre KI-Tools dokumentieren. Diese werden automatisch in eine Tabelle integriert.
\aitoolentry{GPT-4o}{Proofreading}{``Hello, I'm writing my bachelor thesis with the title `[title]'. Can you help me proofread my work? I'd prefer you to explain the issues in the original than to simple correct them! I will send you individual sections as they are ready. Focus on sentence structure, clarity, and grammar and spelling mistakes.'' Entire Document}

%
% Hier beginnen die Verzeichnisse
%
\clearpage
\printbibliography
\clearpage

% Das Abbildungsverzeichnis
\listoffigures
\clearpage

% Das Tabellenverzeichnis
\listoftables
\clearpage

% Das Verzeichnis über die verwendeten KI-Tools
\listaitools
\clearpage

\phantomsection
\addcontentsline{toc}{chapter}{\listacroname}
\chapter*{\listacroname}
\begin{acronym}[XXXXX]
    \acro{VM}[VM]{virtual machine}
    \acro{OS}[OS]{Operating System}
    \acro{HTTP}[HTTP]{Hypertext Transfer Protocol}
    \acro{HTTPS}[HTTPS]{Hypertext Transfer Protocol Secure}
    \acro{SSH}[SSH]{Secure Shell}
    \acro{TLS}[TLS]{Transport Layer Security}
    \acro{SSL}[SSL]{Secure Sockets Layer}
    \acro{CI}[CI]{continuous integration}
\end{acronym}

%
% Hier beginnt der Anhang.
%
\clearpage
\appendix
%\chapter{Mermaid Source Code}\label{appendix_mermaid}
%\clearpage
\chapter{Source Code}\label{appendix_config}

\section{Base Configuration}\label{appendix_base_config}

\begin{code}
\captionof{listing}{Vagrantfile}
\label{code:Vagrantfile}
\begin{minted}[breaklines,fontsize=\footnotesize]{ruby}
Vagrant.configure("2") do |config|

  BOX_NAME = "ubuntu/jammy64"
  BOX_VERSION = "20241002.0.0"

  DESKTOP_BOX_NAME = "kalilinux/rolling"
  DESKTOP_BOX_VERSION = "2025.1.0"

  config.vm.define "sandbox" do |sandbox|
    sandbox.vm.box = BOX_NAME
    sandbox.vm.box_version = BOX_VERSION
    sandbox.vm.hostname = "sandbox.vm"
    sandbox.vm.network "private_network", ip: "192.168.56.10"

    sandbox.vm.provider "virtualbox" do |v|
      v.memory = 2048
      v.cpus = 2
    end

    sandbox.vm.synced_folder ".", "/vagrant"

    sandbox.vm.provision "ansible_local" do |ansible|
      ansible.playbook = "/vagrant/sandbox/playbook.yml"
    end
  end

  config.vm.define "client" do |client|
    client.vm.box = DESKTOP_BOX_NAME
    client.vm.box_version = DESKTOP_BOX_VERSION
    client.vm.hostname = "client.vm"
    client.vm.network "private_network", ip: "192.168.56.20"

    client.vm.provider "virtualbox" do |v|
      v.memory = 4096
      v.cpus = 2
    end

    client.vm.synced_folder ".", "/vagrant"
    
    client.vm.provision "ansible_local" do |ansible|
      ansible.playbook = "/vagrant/client/playbook.yml"
    end
  end
end
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{sandbox/docker-compose.yml}
\label{code:sandbox:docker}
\begin{minted}[breaklines,fontsize=\footnotesize]{yaml}
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    networks:
      - internal
    environment:
      DOMAIN: "https://bitwarden.vm.local"
      DATABASE_URL: "postgres://vaultwarden:vaultwarden@vaultwarden-db/vaultwarden"
    volumes:
      - ./vw-data/:/data/
    expose:
      - 80

  vaultwarden-db:
    image: docker.io/library/postgres:latest
    container_name: vaultwarden-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: vaultwarden
      POSTGRES_USER: vaultwarden
      POSTGRES_PASSWORD: vaultwarden
    volumes:
      - ./vw-postgres:/var/lib/postgresql/data
    networks:
      - internal

  gitea:
    image: docker.gitea.com/gitea:latest
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=gitea-db:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=gitea
      - GITEA__security__INSTALL_LOCK=true
    restart: unless-stopped
    networks:
      - internal
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    expose:
      - 3000
      - 22

  gitea-db:
    image: docker.io/library/postgres:latest
    container_name: gitea-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea
      - POSTGRES_DB=gitea
    volumes:
      - ./postgres:/var/lib/postgresql/data
    networks:
      - internal

  nginx:
    image: nginx:latest
    container_name: nginx
    restart: unless-stopped
    networks:
      - internal
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf
      - ./nginx/certs:/etc/nginx/certs
    ports:
      - 80:80
      - 443:443

networks:
  internal:
    driver: bridge
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{sandbox/playbook.yml}
\label{code:sandbox:ansible}
\begin{minted}[breaklines,fontsize=\footnotesize]{yaml}
---
- hosts: all
  become: true
  vars:
    container_count: 1
    default_container_name: docker
    default_container_image: hello-world
    default_container_command: sleep 1
  tasks:
    - name: Install required system packages
      apt:
        pkg:
          - apt-transport-https
          - ca-certificates
          - curl
          - software-properties-common
          - virtualenv
        state: latest
        update_cache: true
        
    - name: Copy nginx conf
      copy:
        src: /vagrant/sandbox/nginx.conf
        dest: /home/vagrant/nginx.conf

    - name: Copy docker compose
      copy:
        src: /vagrant/sandbox/docker-compose.yml
        dest: /home/vagrant/docker-compose.yml

    - name: Ensure certs directory exists
      file:
        path: /home/vagrant/nginx/certs
        state: directory
        mode: '0755'

    - name: Install mkcert dependencies
      apt:
        pkg:
          - libnss3-tools
          - ca-certificates
        state: present
        update_cache: yes

    - name: Download mkcert binary
      get_url:
        url: https://github.com/FiloSottile/mkcert/releases/latest/download/mkcert-v1.4.4-linux-amd64
        dest: /usr/local/bin/mkcert
        mode: '0755'
      register: mkcert_download

    - name: Ensure mkcert CAROOT directory exists
      file:
        path: /home/vagrant/.local/share/mkcert
        state: directory
        mode: '0755'

    - name: Initialize mkcert CA
      command: mkcert -install
      environment:
        XDG_DATA_HOME: /home/vagrant/.local/share
        CAROOT: /home/vagrant/.local/share/mkcert
      args:
        creates: /home/vagrant/.local/share/mkcert/rootCA.pem

    - name: Generate cert for gitea.vm.local
      command: >
        mkcert
        -cert-file /home/vagrant/nginx/certs/gitea.vm.local.pem
        -key-file /home/vagrant/nginx/certs/gitea.vm.local-key.pem
        gitea.vm.local
      args:
        creates: /home/vagrant/nginx/certs/gitea.vm.local.pem

    - name: Generate cert for bitwarden.vm.local
      command: >
        mkcert
        -cert-file /home/vagrant/nginx/certs/bitwarden.vm.local.pem
        -key-file /home/vagrant/nginx/certs/bitwarden.vm.local-key.pem
        bitwarden.vm.local
      args:
        creates: /home/vagrant/nginx/certs/bitwarden.vm.local.pem

    - name: Ensure export directory exists
      file:
        path: /vagrant/shared/ca
        state: directory
        mode: '0755'

    - name: Copy mkcert rootCA.pem to shared directory
      copy:
        src: /home/vagrant/.local/share/mkcert/rootCA.pem
        dest: /vagrant/shared/ca/rootCA.pem
        remote_src: yes

    - name: Add Docker GPG apt Key
      apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
        state: present

    - name: Add Docker Repository
      apt_repository:
        repo: deb https://download.docker.com/linux/ubuntu focal stable
        state: present

    - name: Update apt and install docker-ce
      apt:
        pkg:
          - docker-ce
          - docker-compose-plugin
        state: latest
        update_cache: true

    - name: Add 'vagrant' and 'git' users to docker group
      user:
        name: "{{ item }}"
        groups: docker
        append: yes
      loop:
        - vagrant
        - git

    - name: Create git user
      user:
        name: git
        shell: /home/git/docker-shell
        home: /home/git
        create_home: yes

    - name: Deploy docker passthrough shell
      copy:
        dest: /home/git/docker-shell
        content: |
          #!/bin/sh
          exec /usr/bin/docker exec -i -u git --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" gitea sh "$@"
        mode: '0755'

    - name: Update SSH config for git user
      blockinfile:
        path: /etc/ssh/sshd_config
        block: |
          Match User git
            AuthorizedKeysCommandUser git
            AuthorizedKeysCommand /usr/bin/docker exec -i -u git gitea /usr/local/bin/gitea keys -c /data/gitea/conf/app.ini -e git -u %u -t %t -k %k

    - name: Restart SSH
      service:
        name: ssh
        state: restarted

    - name: Ensure Docker service is running
      service:
        name: docker
        state: started
        enabled: true

    - name: Run docker compose up -d
      command: docker compose up -d
      args:
        chdir: /home/vagrant
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{sandbox/nginx.conf}
\label{code:sandbox:nginx}
\begin{minted}[breaklines,fontsize=\footnotesize]{text}
server {
  listen 443 ssl;
  server_name gitea.vm.local;

  ssl_certificate /etc/nginx/certs/gitea.vm.local.pem;
  ssl_certificate_key /etc/nginx/certs/gitea.vm.local-key.pem;

  location / {
    proxy_pass http://gitea:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}

server {
  listen 443 ssl;
  server_name bitwarden.vm.local;

  ssl_certificate /etc/nginx/certs/bitwarden.vm.local.pem;
  ssl_certificate_key /etc/nginx/certs/bitwarden.vm.local-key.pem;

  location / {
    proxy_pass http://vaultwarden:80;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}

server {
  listen 80;
  server_name _;
  return 301 https://$host$request_uri;
}
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{client/playbook.yml}
\label{code:client:ansible}
\begin{minted}[breaklines,fontsize=\footnotesize]{yaml}
---
- hosts: all
  become: true
  vars:
    container_count: 1
    default_container_name: docker
    default_container_image: hello-world
    default_container_command: sleep 1
  tasks:
#    - name: Add Metasploit PPA
#      apt_repository:
#        repo: ppa:metasploit-official
#        state: present
#        update_cache: yes

    - name: Install tools
      apt:
        pkg:
#          - metasploit-framework
          - curl
          - nmap
          - libnss3-tools
        state: present
        update_cache: yes

    - name: Add sandbox hostnames to /etc/hosts
      lineinfile:
        path: /etc/hosts
        line: "192.168.56.10 gitea.vm.local bitwarden.vm.local"
        state: present
\end{minted}
\end{code}

\clearpage

\section{Configuration Modifications}\label{appendix_patches}

\clearpage

\chapter{Test Results}\label{appendix_results}
\section{Command Outputs}\label{appendix_logs}

All commands shown in the following section are either bash commands, or metasploit commands\footnote{Metasploit commands are entered into the metasploit console after starting it using the command \texttt{msfconsole}}, if not indicated otherwise. As metasploit commands usually consist of multiple configuration options, the listing itself often contains further commands, which are indicated by the default greater-than symbol.

\begin{code}
\captionof{listing}{\texttt{echo "Hello, World!"}}
\label{log:empty}
\begin{minted}[breaklines,fontsize=\footnotesize]{text}
Hello, World!
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{nmap -sS 192.168.56.10} on the base system (client)}
\label{log:base:nmap_sS}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-17 12:10 EDT
Nmap scan report for gitea.vm.local (192.168.56.10)
Host is up (0.00011s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
2222/tcp open  EtherNetIP-1
MAC Address: 08:00:27:D6:26:3F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{curl -kI 192.168.56.10} on the base system (client)}
\label{log:base:curl_I}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
HTTP/1.1 301 Moved Permanently
Server: nginx/1.27.4
Date: Sat, 19 Apr 2025 11:21:48 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://192.168.56.10/
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{curl -kIL bitwarden.vm.local} on the base system (client)}
\label{log:base:curl_IL_bitwarden}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
HTTP/1.1 301 Moved Permanently
Server: nginx/1.27.4
Date: Sat, 19 Apr 2025 11:27:44 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://bitwarden.vm.local/

HTTP/1.1 200 OK
Server: nginx/1.27.4
Date: Sat, 19 Apr 2025 11:27:44 GMT
Content-Length: 0
Connection: keep-alive
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
referrer-policy: same-origin
x-robots-tag: noindex, nofollow
x-xss-protection: 0
cross-origin-resource-policy: same-origin
content-security-policy: default-src 'none'; font-src 'self'; manifest-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://* ; img-src 'self' data: https://haveibeenpwned.com ; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net ;
cache-control: no-cache, no-store, max-age=0
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{curl -kL bitwarden.vm.local} on the base system (client)}
\label{log:base:curl_L_bitwarden}
\begin{minted}[breaklines,fontsize=\footnotesize]{html}
<!doctype html><html class="theme_light"><head><meta charset="utf-8"/><meta name="viewport" content="width=1010"/><meta name="theme-color" content="#175DDC"/><title page-title>Vaultwarden Web</title><link rel="apple-touch-icon" sizes="180x180" href="images/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="images/favicon-32x32.png"/><link rel="icon" type="image/png" sizes="16x16" href="images/favicon-16x16.png"/><link rel="mask-icon" href="images/safari-pinned-tab.svg" color="#175DDC"/><link rel="manifest" href="cca56971e438d22818d6.json"/><link rel="stylesheet" href="css/vaultwarden.css"/><script defer="defer" src="theme_head.4cb181fc19f2a308ba73.js"></script><link href="styles.210448eea764e08cd3db.css" rel="stylesheet"></head><body class="layout_frontend"><app-root><div class="tw-p-8 tw-flex"><img class="new-logo-themed" alt="Vaultwarden"/><div class="spinner-container tw-justify-center"><i class="bwi bwi-spinner bwi-spin bwi-3x tw-text-muted" title="Loading" aria-hidden="true"></i></div></div></app-root><script defer="defer" src="app/polyfills.c5a5bb8e63f572e1aad3.js"></script><script defer="defer" src="app/vendor.a472624478da807c2f59.js"></script><script defer="defer" src="app/main.d867124a6761f6de6826.js"></script><script defer="defer" src="styles.31d6cfe0d16ae931b73c.js"></script></body></html>
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{curl -kIL gitea.vm.local} on the base system (client)}
\label{log:base:curl_IL_gitea}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
HTTP/1.1 301 Moved Permanently
Server: nginx/1.27.4
Date: Sat, 19 Apr 2025 11:35:10 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://gitea.vm.local/

HTTP/1.1 200 OK
Server: nginx/1.27.4
Date: Sat, 19 Apr 2025 11:35:10 GMT
Connection: keep-alive
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{curl -kL gitea.vm.local} on the base system (client); empty lines and repeating section omitted for brevity, shown with an elipsis instead}
\label{log:base:curl_L_gitea}
\begin{minted}[breaklines,obeytabs=true,tabsize=2,breakanywhere,fontsize=\footnotesize]{html}
<!DOCTYPE html>
<html lang="en-US" data-theme="gitea-auto">
<head>
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Gitea: Git with a cup of tea</title>
	<link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiR2l0ZWE6IEdpdCB3aXRoIGEgY3VwIG9mIHRlYSIsInNob3J0X25hbWUiOiJHaXRlYTogR2l0IHdpdGggYSBjdXAgb2YgdGVhIiwic3RhcnRfdXJsIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwLyIsImljb25zIjpbeyJzcmMiOiJodHRwOi8vbG9jYWxob3N0OjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLCJzaXplcyI6IjUxMng1MTIifSx7InNyYyI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hc3NldHMvaW1nL2xvZ28uc3ZnIiwidHlwZSI6ImltYWdlL3N2Zyt4bWwiLCJzaXplcyI6IjUxMng1MTIifV19">
	... meta tags ...
	<link rel="icon" href="/assets/img/favicon.svg" type="image/svg+xml">
	<link rel="alternate icon" href="/assets/img/favicon.png" type="image/png">
<script>
	window.addEventListener('error', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
	window.addEventListener('unhandledrejection', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
	window.config = {
		appUrl: 'http:\/\/localhost:3000\/',
		appSubUrl: '',
		assetVersionEncoded: encodeURIComponent('1.23.7'),
		assetUrlPrefix: '\/assets',
		runModeIsProd:  true ,
		customEmojis: {...},
		csrfToken: '...',
		pageData: {},
		notificationSettings: {"EventSourceUpdateTime":10000,"MaxTimeout":60000,"MinTimeout":10000,"TimeoutStep":10000}, 
		enableTimeTracking:  true ,
		mermaidMaxSourceCharacters:  5000 ,
		i18n: {
			...
		},
	};
	
	window.config.pageData = window.config.pageData || {};
</script>
<script src="/assets/js/webcomponents.js?v=1.23.7"></script>
	<noscript>
		<style>
			.dropdown:hover > .menu { display: block; }
			.ui.secondary.menu .dropdown.item > .menu { margin-top: 0; }
		</style>
	</noscript>
	<meta property="og:title" content="Gitea: Git with a cup of tea">
	<meta property="og:type" content="website">
	<meta property="og:image" content="/assets/img/logo.png">
	<meta property="og:url" content="http://localhost:3000/">
	<meta property="og:description" content="Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go">
<meta property="og:site_name" content="Gitea: Git with a cup of tea">
	<link rel="stylesheet" href="/assets/css/index.css?v=1.23.7">
<link rel="stylesheet" href="/assets/css/theme-gitea-auto.css?v=1.23.7">
</head>
<body hx-headers='{"x-csrf-token": "-AxjXrZkccvGWZ6ikXDTsMgRNps6MTc0NTA2MjUzNDc0OTU2NTM4MQ"}' hx-swap="outerHTML" hx-ext="morph" hx-push-url="false">
	<div class="full height">
		<noscript>This website requires JavaScript.</noscript>
<nav id="navbar" aria-label="Navigation Bar">
	<div class="navbar-left">
		<a class="item" id="navbar-logo" href="/" aria-label="Home">
			<img width="30" height="30" src="/assets/img/logo.svg" alt="Logo" aria-hidden="true">
		</a>
		<div class="ui secondary menu navbar-mobile-right only-mobile">
			<button class="item tw-w-auto ui icon mini button tw-p-2 tw-m-0" id="navbar-expand-toggle" aria-label="Navigation Menu"><svg viewBox="0 0 16 16" class="svg octicon-three-bars" aria-hidden="true" width="16" height="16"><path d="..."/></svg></button>
		</div>
			<a class="item" href="/explore/repos">Explore</a>
			<a class="item" target="_blank" rel="noopener noreferrer" href="https://docs.gitea.com">Help</a>
	</div>
	<div class="navbar-right">
				<a class="item" href="/user/sign_up">
					<svg viewBox="0 0 16 16" class="svg octicon-person" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Register
				</a>
			<a class="item" rel="nofollow" href="/user/login?redirect_to=%2f">
				<svg viewBox="0 0 16 16" class="svg octicon-sign-in" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Sign In
			</a>
	</div>
</nav>
<div role="main" aria-label="Home" class="page-content home">
	<div class="tw-mb-8 tw-px-8">
		<div class="center">
			<img class="logo" width="220" height="220" src="/assets/img/logo.svg" alt="Logo">
			<div class="hero">
				<h1 class="ui icon header title">
					Gitea: Git with a cup of tea
				</h1>
				<h2>A painless, self-hosted Git service</h2>
			</div>
		</div>
	</div>
	<div class="ui stackable middle very relaxed page grid">
		<div class="eight wide center column">
			<h1 class="hero ui icon header">
				<svg viewBox="0 0 16 16" class="svg octicon-flame" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Easy to install
			</h1>
			<p class="large">
				Simply <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.com/installation/install-from-binary">run the binary</a> for your platform, ship it with <a target="_blank" rel="noopener noreferrer" href="https://github.com/go-gitea/gitea/tree/master/docker">Docker</a>, or get it <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.com/installation/install-from-package">packaged</a>.
			</p>
		</div>
		<div class="eight wide center column">
			<h1 class="hero ui icon header">
				<svg viewBox="0 0 16 16" class="svg octicon-device-desktop" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Cross-platform
			</h1>
			<p class="large">
				Gitea runs anywhere <a target="_blank" rel="noopener noreferrer" href="https://go.dev/">Go</a> can compile for: Windows, macOS, Linux, ARM, etc. Choose the one you love!
			</p>
		</div>
	</div>
	<div class="ui stackable middle very relaxed page grid">
		<div class="eight wide center column">
			<h1 class="hero ui icon header">
				<svg viewBox="0 0 16 16" class="svg octicon-rocket" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Lightweight
			</h1>
			<p class="large">
				Gitea has low minimal requirements and can run on an inexpensive Raspberry Pi. Save your machine energy!
			</p>
		</div>
		<div class="eight wide center column">
			<h1 class="hero ui icon header">
				<svg viewBox="0 0 16 16" class="svg octicon-code" aria-hidden="true" width="16" height="16"><path d="..."/></svg> Open Source
			</h1>
			<p class="large">
				Go get <a target="_blank" rel="noopener noreferrer" href="https://code.gitea.io/gitea">code.gitea.io/gitea</a>! Join us by <a target="_blank" rel="noopener noreferrer" href="https://github.com/go-gitea/gitea">contributing</a> to make this project even better. Don't be shy to be a contributor!
			</p>
		</div>
	</div>
</div>
	</div>
	<footer class="page-footer" role="group" aria-label="Footer">
	<div class="left-links" role="contentinfo" aria-label="About Software">
			<a target="_blank" rel="noopener noreferrer" href="https://about.gitea.com">Powered by Gitea</a>
			Version:
				1.23.7
			Page: <strong>18ms</strong>
			Template: <strong>5ms</strong>
	</div>
	<div class="right-links" role="group" aria-label="Links">
		<div class="ui dropdown upward">
			<span class="flex-text-inline"><svg viewBox="0 0 16 16" class="svg octicon-globe" aria-hidden="true" width="14" height="14"><path d="..."/></svg> English</span>
			<div class="menu language-menu">
				<a lang="id-ID" data-url="/?lang=id-ID" class="item ">Bahasa Indonesia</a>
				<a lang="de-DE" data-url="/?lang=de-DE" class="item ">Deutsch</a>
				<a lang="en-US" data-url="/?lang=en-US" class="item selected">English</a>
				...
				</div>
		</div>
		<a href="/assets/licenses.txt">Licenses</a>
		<a href="/api/swagger">API</a>
	</div>
</footer>
	<script src="/assets/js/index.js?v=1.23.7" onerror="alert('Failed to load asset files from ' + this.src + '. Please make sure the asset files can be accessed.')"></script>
</body>
</html>
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{msf6 > use auxiliary/scanner/ssh/ssh\_login} on the base system (client)}
\label{log:base:metasploit:ssh_login}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
msf6 auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.56.10
msf6 auxiliary(scanner/ssh/ssh_login) > set rport 2222
msf6 auxiliary(scanner/ssh/ssh_login) > set username root
msf6 auxiliary(scanner/ssh/ssh_login) > set password root
msf6 auxiliary(scanner/ssh/ssh_login) > exploit
[*] 192.168.56.10:2222 - Starting bruteforce
[+] 192.168.56.10:2222 - Success: 'root:root' 'uid=0(root) gid=0(root) groups=0(root) Linux 0e6d64e04e9d 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux '
[*] SSH session 1 opened (192.168.56.28:34687 -> 192.168.56.10:2222) at 2025-05-12 13:47:23 -0400
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ssh/ssh_login) > sessions -i 1
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{dig gitea} on the base system (vulnerable container via ssh)}
\label{log:base:vuln:dig_gitea}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> gitea
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35068
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gitea.                         IN      A

;; ANSWER SECTION:
gitea.                  600     IN      A       172.18.0.4

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Mon May 12 18:14:57 UTC 2025
;; MSG SIZE  rcvd: 44
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{dig bitwarden} on the base system (vulnerable container via ssh)}
\label{log:base:vuln:dig_bitwarden}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> bitwarden
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12038
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;bitwarden.                     IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Mon May 12 18:15:05 UTC 2025
;; MSG SIZE  rcvd: 27
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{dig vaultwarden} on the base system (vulnerable container via ssh)}
\label{log:base:vuln:dig_vaultwarden}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> vaultwarden
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21853
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;vaultwarden.                   IN      A

;; ANSWER SECTION:
vaultwarden.            600     IN      A       172.18.0.2

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Mon May 12 18:27:21 UTC 2025
;; MSG SIZE  rcvd: 56
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{nmap -sS 172.18.0.0/16} on the base system (vulnerable container via ssh)}
\label{log:base:vuln:nmap}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
Starting Nmap 7.80 ( https://nmap.org ) at 2025-05-17 16:31 UTC
Nmap scan report for sandbox (172.18.0.1)
Host is up (0.0000050s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
2222/tcp open  EtherNetIP-1
MAC Address: FA:B1:5A:9D:C7:A5 (Unknown)

Nmap scan report for vaultwarden.vagrant_nginx (172.18.0.2)
Host is up (0.0000050s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http
MAC Address: BE:9D:68:8A:B6:B6 (Unknown)

Nmap scan report for nginx.vagrant_nginx (172.18.0.3)
Host is up (0.0000050s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
MAC Address: D6:71:74:1E:27:A2 (Unknown)

Nmap scan report for gitea.vagrant_nginx (172.18.0.5)
Host is up (0.0000050s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp
MAC Address: 9A:E8:19:FC:FF:25 (Unknown)
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{nmap -sS 172.18.0.0/16} on the hybrid system (vulnerable container via ssh)}
\label{log:hybrid:vuln:nmap}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
Starting Nmap 7.80 ( https://nmap.org ) at 2025-05-18 13:11 UTC
Nmap scan report for postgres (172.18.0.1)
Host is up (0.000012s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
2222/tcp open  EtherNetIP-1
5432/tcp open  postgresql
MAC Address: 26:54:2A:8A:53:02 (Unknown)

Nmap scan report for nginx.vagrant_internal (172.18.0.2)
Host is up (0.000012s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
MAC Address: CE:E7:60:35:0E:C1 (Unknown)

Nmap scan report for gitea.vagrant_internal (172.18.0.4)
Host is up (0.000012s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp
MAC Address: 7E:05:23:CA:55:6D (Unknown)

Nmap scan report for vaultwarden.vagrant_internal (172.18.0.5)
Host is up (0.000012s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 12:EB:C9:6D:07:4B (Unknown)
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{Establishing a port forward from a metasploit session; shown on the hybrid system (client), functionaly independent of system}
\label{log:hybrid:meterpreter:fwd}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
msf6 > sessions -u 1
msf6 > sessions -i 2
meterpreter > portfwd add -l 5432 -p 5432 -r 172.18.0.1
[*] Forward TCP relay created: (local) :5432 -> (remote) 172.18.0.1:5432
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{metasploit auxiliary/scanner/postgres/postgres\_version modules; shown on the hybrid system (client)}
\label{log:hybrid:portfwd:postgres_version}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
msf6 auxiliary(server/capture/postgresql) > use auxiliary/scanner/postgres/postgres_version 
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf6 auxiliary(scanner/postgres/postgres_version) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf6 auxiliary(scanner/postgres/postgres_version) > run
[*] 127.0.0.1:5432 Postgres - Version Unknown (Pre-Auth)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{metasploit auxiliary/scanner/postgres/postgres\_version modules; shown on the hybrid system (client)}
\label{log:hybrid:portfwd:postgres_bruteforce}
\begin{minted}[breaklines,fontsize=\footnotesize]{shell}
msf6 auxiliary(scanner/postgres/postgres_login) > use auxiliary/scanner/postgres/postgres_login
[*] New in Metasploit 6.4 - The CreateSession option within this module can open an interactive session
msf6 auxiliary(scanner/postgres/postgres_login) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf6 auxiliary(scanner/postgres/postgres_login) > set BLANK_PASSWORDS true
BLANK_PASSWORDS => true
msf6 auxiliary(scanner/postgres/postgres_login) > run
[!] No active DB -- Credential data will not be saved!
[-] 127.0.0.1:5432 - LOGIN FAILED: :@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: :@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: :tiger@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: :postgres@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: :password@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: :admin@template1 (Incorrect: FATAL	VFATAL	C28000	Mno PostgreSQL user name specified in startup packet	Fpostmaster.c	L2273	RProcessStartupPacket)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:tiger@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:postgres@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:password@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:admin@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:tiger@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:postgres@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:password@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: scott:admin@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "scott"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:tiger@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:postgres@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:password@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:admin@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:postgres@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:password@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: postgres:admin@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "postgres"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:admin@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[-] 127.0.0.1:5432 - LOGIN FAILED: admin:password@template1 (Incorrect: FATAL	VFATAL	C28P01	Mpassword authentication failed for user "admin"	Fauth.c	L335	Rauth_failed)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Bruteforce completed, 0 credentials were successful.
[*] You can open a Postgres session with these credentials and CreateSession set to true
[*] Auxiliary module execution completed
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{\texttt{metasploit}}
\label{log:base:metasploit:test}
\begin{minted}[breaklines,fontsize=\footnotesize]{text}
Hello, World!
\end{minted}
\end{code}

%\begin{code}
%\captionof{listing}{\texttt{metasplou123t}\footnote{Metasploit commands are entered into the metasploit console after starting it using the command \texttt{msfconsole}}}
%\label{log:base:metasploit:test2}
%\begin{minted}[breaklines,fontsize=\footnotesize]{text}
%Hello, World!
%\end{minted}
%\end{code}

\section{Docker Bench Results}\label{appendix_docker_bench}

Docker Bench for Security is a tool based in the CIS Docker benchmark\footnote{\url{https://www.cisecurity.org/benchmark/docker}}. Docker Bench generates a \texttt{.log} file and a \texttt{.log.json} file; only the raw log files have been included, as they show the same data in a more compact format.

\begin{code}
\captionof{listing}{Base configuration}
\label{docker_bench:base}
\begin{minted}[breaklines,tabsize=2,breakanywhere,fontsize=\footnotesize]{text}
Initializing 2025-05-18T11:42:35+00:00


Section A - Check results[0m

[INFO][0m 1 - Host Configuration
[INFO][0m 1.1 - Linux Hosts Specific Configuration
[WARN][0m 1.1.1 - Ensure a separate partition for containers has been created (Automated)
[INFO][0m 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated)
[INFO][0m       * Users: vagrant,git
[WARN][0m 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated)
[WARN][0m 1.1.4 - Ensure auditing is configured for Docker files and directories -/run/containerd (Automated)
[WARN][0m 1.1.5 - Ensure auditing is configured for Docker files and directories - /var/lib/docker (Automated)
[WARN][0m 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated)
[WARN][0m 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated)
[WARN][0m 1.1.8 - Ensure auditing is configured for Docker files and directories - containerd.sock (Automated)
[WARN][0m 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated)
[WARN][0m 1.1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker (Automated)
[INFO][0m 1.1.11 - Ensure auditing is configured for Dockerfiles and directories - /etc/docker/daemon.json (Automated)
[INFO][0m        * File not found
[WARN][0m 1.1.12 - 1.1.12 Ensure auditing is configured for Dockerfiles and directories - /etc/containerd/config.toml (Automated)
[INFO][0m 1.1.13 - Ensure auditing is configured for Docker files and directories - /etc/sysconfig/docker (Automated)
[INFO][0m        * File not found
[WARN][0m 1.1.14 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd (Automated)
[WARN][0m 1.1.15 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim (Automated)
[WARN][0m 1.1.16 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v1 (Automated)
[WARN][0m 1.1.17 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v2 (Automated)
[WARN][0m 1.1.18 - Ensure auditing is configured for Docker files and directories - /usr/bin/runc (Automated)
[INFO][0m 1.2 - General Configuration
[NOTE][0m 1.2.1 - Ensure the container host has been Hardened (Manual)
[PASS][0m 1.2.2 - Ensure that the version of Docker is up to date (Manual)
[INFO][0m        * Using 28.1.1 which is current
[INFO][0m        * Check with your operating system vendor for support and security maintenance for Docker

[INFO][0m 2 - Docker daemon configuration
[NOTE][0m 2.1 - Run the Docker daemon as a non-root user, if possible (Manual)
[WARN][0m 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored)
[PASS][0m 2.3 - Ensure the logging level is set to 'info' (Scored)
[PASS][0m 2.4 - Ensure Docker is allowed to make changes to iptables (Scored)
[PASS][0m 2.5 - Ensure insecure registries are not used (Scored)
[PASS][0m 2.6 - Ensure aufs storage driver is not used (Scored)
[INFO][0m 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored)
[INFO][0m      * Docker daemon not listening on TCP
[INFO][0m 2.8 - Ensure the default ulimit is configured appropriately (Manual)
[INFO][0m      * Default ulimit doesn't appear to be set
[WARN][0m 2.9 - Enable user namespace support (Scored)
[PASS][0m 2.10 - Ensure the default cgroup usage has been confirmed (Scored)
[PASS][0m 2.11 - Ensure base device size is not changed until needed (Scored)
[WARN][0m 2.12 - Ensure that authorization for Docker client commands is enabled (Scored)
[WARN][0m 2.13 - Ensure centralized and remote logging is configured (Scored)
[WARN][0m 2.14 - Ensure containers are restricted from acquiring new privileges (Scored)
[WARN][0m 2.15 - Ensure live restore is enabled (Scored)
[WARN][0m 2.16 - Ensure Userland Proxy is Disabled (Scored)
[INFO][0m 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual)
[INFO][0m Ensure that experimental features are not implemented in production (Scored) (Deprecated)

[INFO][0m 3 - Docker daemon configuration files
[PASS][0m 3.1 - Ensure that the docker.service file ownership is set to root:root (Automated)
[PASS][0m 3.2 - Ensure that docker.service file permissions are appropriately set (Automated)
[PASS][0m 3.3 - Ensure that docker.socket file ownership is set to root:root (Automated)
[PASS][0m 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive (Automated)
[PASS][0m 3.5 - Ensure that the /etc/docker directory ownership is set to root:root (Automated)
[PASS][0m 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictively (Automated)
[INFO][0m 3.7 - Ensure that registry certificate file ownership is set to root:root (Automated)
[INFO][0m      * Directory not found
[INFO][0m 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m      * Directory not found
[INFO][0m 3.9 - Ensure that TLS CA certificate file ownership is set to root:root (Automated)
[INFO][0m      * No TLS CA certificate found
[INFO][0m 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m       * No TLS CA certificate found
[INFO][0m 3.11 - Ensure that Docker server certificate file ownership is set to root:root (Automated)
[INFO][0m       * No TLS Server certificate found
[INFO][0m 3.12 - Ensure that the Docker server certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m       * No TLS Server certificate found
[INFO][0m 3.13 - Ensure that the Docker server certificate key file ownership is set to root:root (Automated)
[INFO][0m       * No TLS Key found
[INFO][0m 3.14 - Ensure that the Docker server certificate key file permissions are set to 400 (Automated)
[INFO][0m       * No TLS Key found
[PASS][0m 3.15 - Ensure that the Docker socket file ownership is set to root:docker (Automated)
[PASS][0m 3.16 - Ensure that the Docker socket file permissions are set to 660 or more restrictively (Automated)
[INFO][0m 3.17 - Ensure that the daemon.json file ownership is set to root:root (Automated)
[INFO][0m       * File not found
[INFO][0m 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive (Automated)
[INFO][0m       * File not found
[PASS][0m 3.19 - Ensure that the /etc/default/docker file ownership is set to root:root (Automated)
[PASS][0m 3.20 - Ensure that the /etc/default/docker file permissions are set to 644 or more restrictively (Automated)
[INFO][0m 3.21 - Ensure that the /etc/sysconfig/docker file permissions are set to 644 or more restrictively (Automated)
[INFO][0m       * File not found
[INFO][0m 3.22 - Ensure that the /etc/sysconfig/docker file ownership is set to root:root (Automated)
[INFO][0m       * File not found
[PASS][0m 3.23 - Ensure that the Containerd socket file ownership is set to root:root (Automated)
[PASS][0m 3.24 - Ensure that the Containerd socket file permissions are set to 660 or more restrictively (Automated)

[INFO][0m 4 - Container Images and Build File
[WARN][0m 4.1 - Ensure that a user for the container has been created (Automated)
[WARN][0m      * Running as root: vaultwarden-db
[WARN][0m      * Running as root: nginx
[WARN][0m      * Running as root: vaultwarden
[WARN][0m      * Running as root: vagrant-vulnerable-1
[WARN][0m      * Running as root: gitea-db
[WARN][0m      * Running as root: gitea
[NOTE][0m 4.2 - Ensure that containers use only trusted base images (Manual)
[NOTE][0m 4.3 - Ensure that unnecessary packages are not installed in the container (Manual)
[NOTE][0m 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual)
[WARN][0m 4.5 - Ensure Content trust for Docker is Enabled (Automated)
[WARN][0m 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated)
[WARN][0m      * No Healthcheck found: [vagrant-vulnerable:latest]
[WARN][0m      * No Healthcheck found: [docker.gitea.com/gitea:latest]
[WARN][0m      * No Healthcheck found: [postgres:latest]
[WARN][0m      * No Healthcheck found: [nginx:latest]
[INFO][0m 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual)
[INFO][0m      * Update instruction found: [vagrant-vulnerable:latest]
[INFO][0m      * Update instruction found: [postgres:latest]
[NOTE][0m 4.8 - Ensure setuid and setgid permissions are removed (Manual)
[INFO][0m 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual)
[INFO][0m      * ADD in image history: [vagrant-vulnerable:latest]
[INFO][0m      * ADD in image history: [vaultwarden/server:latest]
[NOTE][0m 4.10 - Ensure secrets are not stored in Dockerfiles (Manual)
[NOTE][0m 4.11 - Ensure only verified packages are installed (Manual)
[NOTE][0m 4.12 - Ensure all signed artifacts are validated (Manual)

[INFO][0m 5 - Container Runtime
[PASS][0m 5.1 - Ensure swarm mode is not Enabled, if not needed (Automated)
[PASS][0m 5.2 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated)
[WARN][0m 5.3 - Ensure that, if applicable, SELinux security options are set (Automated)
[WARN][0m      * No SecurityOptions Found: vaultwarden-db
[WARN][0m      * No SecurityOptions Found: nginx
[WARN][0m      * No SecurityOptions Found: vaultwarden
[WARN][0m      * No SecurityOptions Found: vagrant-vulnerable-1
[WARN][0m      * No SecurityOptions Found: gitea-db
[WARN][0m      * No SecurityOptions Found: gitea
[PASS][0m 5.4 - Ensure that Linux kernel capabilities are restricted within containers (Automated)
[PASS][0m 5.5 - Ensure that privileged containers are not used (Automated)
[PASS][0m 5.6 - Ensure sensitive host system directories are not mounted on containers (Automated)
[WARN][0m 5.7 - Ensure sshd is not run within containers (Automated)
[WARN][0m      * Container running sshd: vagrant-vulnerable-1
[WARN][0m      * Container running sshd: gitea
[WARN][0m 5.8 - Ensure privileged ports are not mapped within containers (Automated)
[WARN][0m      * Privileged Port in use: 80 in nginx
[WARN][0m      * Privileged Port in use: 443 in nginx
[WARN][0m 5.9 - Ensure that only needed ports are open on the container (Manual)
[WARN][0m      * Port in use: 80 in nginx
[WARN][0m      * Port in use: 443 in nginx
[WARN][0m      * Port in use: 2222 in vagrant-vulnerable-1
[PASS][0m 5.10 - Ensure that the host's network namespace is not shared (Automated)
[WARN][0m 5.11 - Ensure that the memory usage for containers is limited (Automated)
[WARN][0m       * Container running without memory restrictions: vaultwarden-db
[WARN][0m       * Container running without memory restrictions: nginx
[WARN][0m       * Container running without memory restrictions: vaultwarden
[WARN][0m       * Container running without memory restrictions: vagrant-vulnerable-1
[WARN][0m       * Container running without memory restrictions: gitea-db
[WARN][0m       * Container running without memory restrictions: gitea
[WARN][0m 5.12 - Ensure that CPU priority is set appropriately on containers (Automated)
[WARN][0m       * Container running without CPU restrictions: vaultwarden-db
[WARN][0m       * Container running without CPU restrictions: nginx
[WARN][0m       * Container running without CPU restrictions: vaultwarden
[WARN][0m       * Container running without CPU restrictions: vagrant-vulnerable-1
[WARN][0m       * Container running without CPU restrictions: gitea-db
[WARN][0m       * Container running without CPU restrictions: gitea
[WARN][0m 5.13 - Ensure that the container's root filesystem is mounted as read only (Automated)
[WARN][0m       * Container running with root FS mounted R/W: vaultwarden-db
[WARN][0m       * Container running with root FS mounted R/W: nginx
[WARN][0m       * Container running with root FS mounted R/W: vaultwarden
[WARN][0m       * Container running with root FS mounted R/W: vagrant-vulnerable-1
[WARN][0m       * Container running with root FS mounted R/W: gitea-db
[WARN][0m       * Container running with root FS mounted R/W: gitea
[WARN][0m 5.14 - Ensure that incoming container traffic is bound to a specific host interface (Automated)
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in nginx
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in nginx
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in vagrant-vulnerable-1
[PASS][0m 5.15 - Ensure that the 'on-failure' container restart policy is set to '5' (Automated)
[PASS][0m 5.16 - Ensure that the host's process namespace is not shared (Automated)
[PASS][0m 5.17 - Ensure that the host's IPC namespace is not shared (Automated)
[PASS][0m 5.18 - Ensure that host devices are not directly exposed to containers (Manual)
[INFO][0m 5.19 - Ensure that the default ulimit is overwritten at runtime if needed (Manual)
[INFO][0m       * Container no default ulimit override: vaultwarden-db
[INFO][0m       * Container no default ulimit override: nginx
[INFO][0m       * Container no default ulimit override: vaultwarden
[INFO][0m       * Container no default ulimit override: vagrant-vulnerable-1
[INFO][0m       * Container no default ulimit override: gitea-db
[INFO][0m       * Container no default ulimit override: gitea
[PASS][0m 5.20 - Ensure mount propagation mode is not set to shared (Automated)
[PASS][0m 5.21 - Ensure that the host's UTS namespace is not shared (Automated)
[PASS][0m 5.22 - Ensure the default seccomp profile is not Disabled (Automated)
[NOTE][0m 5.23 - Ensure that docker exec commands are not used with the privileged option (Automated)
[NOTE][0m 5.24 - Ensure that docker exec commands are not used with the user=root option (Manual)
[PASS][0m 5.25 - Ensure that cgroup usage is confirmed (Automated)
[WARN][0m 5.26 - Ensure that the container is restricted from acquiring additional privileges (Automated)
[WARN][0m       * Privileges not restricted: vaultwarden-db
[WARN][0m       * Privileges not restricted: nginx
[WARN][0m       * Privileges not restricted: vaultwarden
[WARN][0m       * Privileges not restricted: vagrant-vulnerable-1
[WARN][0m       * Privileges not restricted: gitea-db
[WARN][0m       * Privileges not restricted: gitea
[WARN][0m 5.27 - Ensure that container health is checked at runtime (Automated)
[WARN][0m       * Health check not set: vaultwarden-db
[WARN][0m       * Health check not set: nginx
[WARN][0m       * Health check not set: vagrant-vulnerable-1
[WARN][0m       * Health check not set: gitea-db
[WARN][0m       * Health check not set: gitea
[INFO][0m 5.28 - Ensure that Docker commands always make use of the latest version of their image (Manual)
[WARN][0m 5.29 - Ensure that the PIDs cgroup limit is used (Automated)
[WARN][0m       * PIDs limit not set: vaultwarden-db
[WARN][0m       * PIDs limit not set: nginx
[WARN][0m       * PIDs limit not set: vaultwarden
[WARN][0m       * PIDs limit not set: vagrant-vulnerable-1
[WARN][0m       * PIDs limit not set: gitea-db
[WARN][0m       * PIDs limit not set: gitea
[PASS][0m 5.30 - Ensure that Docker's default bridge 'docker0' is not used (Manual)
[PASS][0m 5.31 - Ensure that the host's user namespaces are not shared (Automated)
[PASS][0m 5.32 - Ensure that the Docker socket is not mounted inside any containers (Automated)

[INFO][0m 6 - Docker Security Operations
[INFO][0m 6.1 - Ensure that image sprawl is avoided (Manual)
[INFO][0m      * There are currently: 6 images
[INFO][0m 6.2 - Ensure that container sprawl is avoided (Manual)
[INFO][0m      * There are currently a total of 6 containers, with 6 of them currently running

[INFO][0m 7 - Docker Swarm Configuration
[PASS][0m 7.1 - Ensure that the minimum number of manager nodes have been created in a swarm (Automated) (Swarm mode not enabled)
[PASS][0m 7.2 - Ensure that swarm services are bound to a specific host interface (Automated) (Swarm mode not enabled)
[PASS][0m 7.3 - Ensure that all Docker swarm overlay networks are encrypted (Automated)
[PASS][0m 7.4 - Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster (Manual) (Swarm mode not enabled)
[PASS][0m 7.5 - Ensure that swarm manager is run in auto-lock mode (Automated) (Swarm mode not enabled)
[PASS][0m 7.6 - Ensure that the swarm manager auto-lock key is rotated periodically (Manual) (Swarm mode not enabled)
[PASS][0m 7.7 - Ensure that node certificates are rotated as appropriate (Manual) (Swarm mode not enabled)
[PASS][0m 7.8 - Ensure that CA certificates are rotated as appropriate (Manual) (Swarm mode not enabled)
[PASS][0m 7.9 - Ensure that management plane traffic is separated from data plane traffic (Manual) (Swarm mode not enabled)


Section C - Score[0m

[INFO][0m Checks: 117
[INFO][0m Score: 1
\end{minted}
\end{code}

\begin{code}
\captionof{listing}{Hybrid configuration}
\label{docker_bench:hybrid}
\begin{minted}[breaklines,tabsize=2,breakanywhere,fontsize=\footnotesize]{text}
Initializing 2025-05-18T12:00:06+00:00


Section A - Check results[0m

[INFO][0m 1 - Host Configuration
[INFO][0m 1.1 - Linux Hosts Specific Configuration
[WARN][0m 1.1.1 - Ensure a separate partition for containers has been created (Automated)
[INFO][0m 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated)
[INFO][0m       * Users: vagrant,git
[WARN][0m 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated)
[WARN][0m 1.1.4 - Ensure auditing is configured for Docker files and directories -/run/containerd (Automated)
[WARN][0m 1.1.5 - Ensure auditing is configured for Docker files and directories - /var/lib/docker (Automated)
[WARN][0m 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated)
[WARN][0m 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated)
[WARN][0m 1.1.8 - Ensure auditing is configured for Docker files and directories - containerd.sock (Automated)
[WARN][0m 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated)
[WARN][0m 1.1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker (Automated)
[INFO][0m 1.1.11 - Ensure auditing is configured for Dockerfiles and directories - /etc/docker/daemon.json (Automated)
[INFO][0m        * File not found
[WARN][0m 1.1.12 - 1.1.12 Ensure auditing is configured for Dockerfiles and directories - /etc/containerd/config.toml (Automated)
[INFO][0m 1.1.13 - Ensure auditing is configured for Docker files and directories - /etc/sysconfig/docker (Automated)
[INFO][0m        * File not found
[WARN][0m 1.1.14 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd (Automated)
[WARN][0m 1.1.15 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim (Automated)
[WARN][0m 1.1.16 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v1 (Automated)
[WARN][0m 1.1.17 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v2 (Automated)
[WARN][0m 1.1.18 - Ensure auditing is configured for Docker files and directories - /usr/bin/runc (Automated)
[INFO][0m 1.2 - General Configuration
[NOTE][0m 1.2.1 - Ensure the container host has been Hardened (Manual)
[PASS][0m 1.2.2 - Ensure that the version of Docker is up to date (Manual)
[INFO][0m        * Using 28.1.1 which is current
[INFO][0m        * Check with your operating system vendor for support and security maintenance for Docker

[INFO][0m 2 - Docker daemon configuration
[NOTE][0m 2.1 - Run the Docker daemon as a non-root user, if possible (Manual)
[WARN][0m 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored)
[PASS][0m 2.3 - Ensure the logging level is set to 'info' (Scored)
[PASS][0m 2.4 - Ensure Docker is allowed to make changes to iptables (Scored)
[PASS][0m 2.5 - Ensure insecure registries are not used (Scored)
[PASS][0m 2.6 - Ensure aufs storage driver is not used (Scored)
[INFO][0m 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored)
[INFO][0m      * Docker daemon not listening on TCP
[INFO][0m 2.8 - Ensure the default ulimit is configured appropriately (Manual)
[INFO][0m      * Default ulimit doesn't appear to be set
[WARN][0m 2.9 - Enable user namespace support (Scored)
[PASS][0m 2.10 - Ensure the default cgroup usage has been confirmed (Scored)
[PASS][0m 2.11 - Ensure base device size is not changed until needed (Scored)
[WARN][0m 2.12 - Ensure that authorization for Docker client commands is enabled (Scored)
[WARN][0m 2.13 - Ensure centralized and remote logging is configured (Scored)
[WARN][0m 2.14 - Ensure containers are restricted from acquiring new privileges (Scored)
[WARN][0m 2.15 - Ensure live restore is enabled (Scored)
[WARN][0m 2.16 - Ensure Userland Proxy is Disabled (Scored)
[INFO][0m 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual)
[INFO][0m Ensure that experimental features are not implemented in production (Scored) (Deprecated)

[INFO][0m 3 - Docker daemon configuration files
[PASS][0m 3.1 - Ensure that the docker.service file ownership is set to root:root (Automated)
[PASS][0m 3.2 - Ensure that docker.service file permissions are appropriately set (Automated)
[PASS][0m 3.3 - Ensure that docker.socket file ownership is set to root:root (Automated)
[PASS][0m 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive (Automated)
[PASS][0m 3.5 - Ensure that the /etc/docker directory ownership is set to root:root (Automated)
[PASS][0m 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictively (Automated)
[INFO][0m 3.7 - Ensure that registry certificate file ownership is set to root:root (Automated)
[INFO][0m      * Directory not found
[INFO][0m 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m      * Directory not found
[INFO][0m 3.9 - Ensure that TLS CA certificate file ownership is set to root:root (Automated)
[INFO][0m      * No TLS CA certificate found
[INFO][0m 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m       * No TLS CA certificate found
[INFO][0m 3.11 - Ensure that Docker server certificate file ownership is set to root:root (Automated)
[INFO][0m       * No TLS Server certificate found
[INFO][0m 3.12 - Ensure that the Docker server certificate file permissions are set to 444 or more restrictively (Automated)
[INFO][0m       * No TLS Server certificate found
[INFO][0m 3.13 - Ensure that the Docker server certificate key file ownership is set to root:root (Automated)
[INFO][0m       * No TLS Key found
[INFO][0m 3.14 - Ensure that the Docker server certificate key file permissions are set to 400 (Automated)
[INFO][0m       * No TLS Key found
[PASS][0m 3.15 - Ensure that the Docker socket file ownership is set to root:docker (Automated)
[PASS][0m 3.16 - Ensure that the Docker socket file permissions are set to 660 or more restrictively (Automated)
[INFO][0m 3.17 - Ensure that the daemon.json file ownership is set to root:root (Automated)
[INFO][0m       * File not found
[INFO][0m 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive (Automated)
[INFO][0m       * File not found
[PASS][0m 3.19 - Ensure that the /etc/default/docker file ownership is set to root:root (Automated)
[PASS][0m 3.20 - Ensure that the /etc/default/docker file permissions are set to 644 or more restrictively (Automated)
[INFO][0m 3.21 - Ensure that the /etc/sysconfig/docker file permissions are set to 644 or more restrictively (Automated)
[INFO][0m       * File not found
[INFO][0m 3.22 - Ensure that the /etc/sysconfig/docker file ownership is set to root:root (Automated)
[INFO][0m       * File not found
[PASS][0m 3.23 - Ensure that the Containerd socket file ownership is set to root:root (Automated)
[PASS][0m 3.24 - Ensure that the Containerd socket file permissions are set to 660 or more restrictively (Automated)

[INFO][0m 4 - Container Images and Build File
[WARN][0m 4.1 - Ensure that a user for the container has been created (Automated)
[WARN][0m      * Running as root: gitea
[WARN][0m      * Running as root: vaultwarden
[WARN][0m      * Running as root: nginx
[WARN][0m      * Running as root: vagrant-vulnerable-1
[NOTE][0m 4.2 - Ensure that containers use only trusted base images (Manual)
[NOTE][0m 4.3 - Ensure that unnecessary packages are not installed in the container (Manual)
[NOTE][0m 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual)
[WARN][0m 4.5 - Ensure Content trust for Docker is Enabled (Automated)
[WARN][0m 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated)
[WARN][0m      * No Healthcheck found: [vagrant-vulnerable:latest]
[WARN][0m      * No Healthcheck found: [docker.gitea.com/gitea:latest]
[WARN][0m      * No Healthcheck found: [nginx:latest]
[INFO][0m 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual)
[INFO][0m      * Update instruction found: [vagrant-vulnerable:latest]
[NOTE][0m 4.8 - Ensure setuid and setgid permissions are removed (Manual)
[INFO][0m 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual)
[INFO][0m      * ADD in image history: [vagrant-vulnerable:latest]
[INFO][0m      * ADD in image history: [vaultwarden/server:latest]
[NOTE][0m 4.10 - Ensure secrets are not stored in Dockerfiles (Manual)
[NOTE][0m 4.11 - Ensure only verified packages are installed (Manual)
[NOTE][0m 4.12 - Ensure all signed artifacts are validated (Manual)

[INFO][0m 5 - Container Runtime
[PASS][0m 5.1 - Ensure swarm mode is not Enabled, if not needed (Automated)
[PASS][0m 5.2 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated)
[WARN][0m 5.3 - Ensure that, if applicable, SELinux security options are set (Automated)
[WARN][0m      * No SecurityOptions Found: gitea
[WARN][0m      * No SecurityOptions Found: vaultwarden
[WARN][0m      * No SecurityOptions Found: nginx
[WARN][0m      * No SecurityOptions Found: vagrant-vulnerable-1
[PASS][0m 5.4 - Ensure that Linux kernel capabilities are restricted within containers (Automated)
[PASS][0m 5.5 - Ensure that privileged containers are not used (Automated)
[PASS][0m 5.6 - Ensure sensitive host system directories are not mounted on containers (Automated)
[WARN][0m 5.7 - Ensure sshd is not run within containers (Automated)
[WARN][0m      * Container running sshd: gitea
[WARN][0m      * Container running sshd: vagrant-vulnerable-1
[WARN][0m 5.8 - Ensure privileged ports are not mapped within containers (Automated)
[WARN][0m      * Privileged Port in use: 80 in nginx
[WARN][0m      * Privileged Port in use: 443 in nginx
[WARN][0m 5.9 - Ensure that only needed ports are open on the container (Manual)
[WARN][0m      * Port in use: 80 in nginx
[WARN][0m      * Port in use: 443 in nginx
[WARN][0m      * Port in use: 2222 in vagrant-vulnerable-1
[PASS][0m 5.10 - Ensure that the host's network namespace is not shared (Automated)
[WARN][0m 5.11 - Ensure that the memory usage for containers is limited (Automated)
[WARN][0m       * Container running without memory restrictions: gitea
[WARN][0m       * Container running without memory restrictions: vaultwarden
[WARN][0m       * Container running without memory restrictions: nginx
[WARN][0m       * Container running without memory restrictions: vagrant-vulnerable-1
[WARN][0m 5.12 - Ensure that CPU priority is set appropriately on containers (Automated)
[WARN][0m       * Container running without CPU restrictions: gitea
[WARN][0m       * Container running without CPU restrictions: vaultwarden
[WARN][0m       * Container running without CPU restrictions: nginx
[WARN][0m       * Container running without CPU restrictions: vagrant-vulnerable-1
[WARN][0m 5.13 - Ensure that the container's root filesystem is mounted as read only (Automated)
[WARN][0m       * Container running with root FS mounted R/W: gitea
[WARN][0m       * Container running with root FS mounted R/W: vaultwarden
[WARN][0m       * Container running with root FS mounted R/W: nginx
[WARN][0m       * Container running with root FS mounted R/W: vagrant-vulnerable-1
[WARN][0m 5.14 - Ensure that incoming container traffic is bound to a specific host interface (Automated)
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in nginx
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in nginx
[WARN][0m       * Port being bound to wildcard IP: 0.0.0.0 in vagrant-vulnerable-1
[PASS][0m 5.15 - Ensure that the 'on-failure' container restart policy is set to '5' (Automated)
[PASS][0m 5.16 - Ensure that the host's process namespace is not shared (Automated)
[PASS][0m 5.17 - Ensure that the host's IPC namespace is not shared (Automated)
[PASS][0m 5.18 - Ensure that host devices are not directly exposed to containers (Manual)
[INFO][0m 5.19 - Ensure that the default ulimit is overwritten at runtime if needed (Manual)
[INFO][0m       * Container no default ulimit override: gitea
[INFO][0m       * Container no default ulimit override: vaultwarden
[INFO][0m       * Container no default ulimit override: nginx
[INFO][0m       * Container no default ulimit override: vagrant-vulnerable-1
[PASS][0m 5.20 - Ensure mount propagation mode is not set to shared (Automated)
[PASS][0m 5.21 - Ensure that the host's UTS namespace is not shared (Automated)
[PASS][0m 5.22 - Ensure the default seccomp profile is not Disabled (Automated)
[NOTE][0m 5.23 - Ensure that docker exec commands are not used with the privileged option (Automated)
[NOTE][0m 5.24 - Ensure that docker exec commands are not used with the user=root option (Manual)
[PASS][0m 5.25 - Ensure that cgroup usage is confirmed (Automated)
[WARN][0m 5.26 - Ensure that the container is restricted from acquiring additional privileges (Automated)
[WARN][0m       * Privileges not restricted: gitea
[WARN][0m       * Privileges not restricted: vaultwarden
[WARN][0m       * Privileges not restricted: nginx
[WARN][0m       * Privileges not restricted: vagrant-vulnerable-1
[WARN][0m 5.27 - Ensure that container health is checked at runtime (Automated)
[WARN][0m       * Health check not set: gitea
[WARN][0m       * Health check not set: nginx
[WARN][0m       * Health check not set: vagrant-vulnerable-1
[INFO][0m 5.28 - Ensure that Docker commands always make use of the latest version of their image (Manual)
[WARN][0m 5.29 - Ensure that the PIDs cgroup limit is used (Automated)
[WARN][0m       * PIDs limit not set: gitea
[WARN][0m       * PIDs limit not set: vaultwarden
[WARN][0m       * PIDs limit not set: nginx
[WARN][0m       * PIDs limit not set: vagrant-vulnerable-1
[PASS][0m 5.30 - Ensure that Docker's default bridge 'docker0' is not used (Manual)
[PASS][0m 5.31 - Ensure that the host's user namespaces are not shared (Automated)
[PASS][0m 5.32 - Ensure that the Docker socket is not mounted inside any containers (Automated)

[INFO][0m 6 - Docker Security Operations
[INFO][0m 6.1 - Ensure that image sprawl is avoided (Manual)
[INFO][0m      * There are currently: 4 images
[INFO][0m 6.2 - Ensure that container sprawl is avoided (Manual)
[INFO][0m      * There are currently a total of 4 containers, with 4 of them currently running

[INFO][0m 7 - Docker Swarm Configuration
[PASS][0m 7.1 - Ensure that the minimum number of manager nodes have been created in a swarm (Automated) (Swarm mode not enabled)
[PASS][0m 7.2 - Ensure that swarm services are bound to a specific host interface (Automated) (Swarm mode not enabled)
[PASS][0m 7.3 - Ensure that all Docker swarm overlay networks are encrypted (Automated)
[PASS][0m 7.4 - Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster (Manual) (Swarm mode not enabled)
[PASS][0m 7.5 - Ensure that swarm manager is run in auto-lock mode (Automated) (Swarm mode not enabled)
[PASS][0m 7.6 - Ensure that the swarm manager auto-lock key is rotated periodically (Manual) (Swarm mode not enabled)
[PASS][0m 7.7 - Ensure that node certificates are rotated as appropriate (Manual) (Swarm mode not enabled)
[PASS][0m 7.8 - Ensure that CA certificates are rotated as appropriate (Manual) (Swarm mode not enabled)
[PASS][0m 7.9 - Ensure that management plane traffic is separated from data plane traffic (Manual) (Swarm mode not enabled)


Section C - Score[0m

[INFO][0m Checks: 117
[INFO][0m Score: 1
\end{minted}
\end{code}

\end{document}