DockerENT by Rohit Sehgal

An Open Source Tool & Framework

Analyze Security issues with running Containers

DockerENT is activE ruNtime application security scanning Tool (RAST tool). It is a pluggable framework written in Python. It comes with a CLI application and a clean Web Interface written using StreamLit.

DockerENT has been designed to detect weak security misconfigurations in production deployments which can lead to severe consequences. This application connects with running containers in the system and fetches the list of weak and vulnerable runtime configurations and generates a report. If invoked through web interface, it can display the scan and audit report in the UI itself.

How to Run


In hurry to test this? Download the latest stable REL from PyPi and run the Web App, everything else is intuitive.

pip install DockerENT

Then run the application like:

DockerENT -w

Thats it.

Run the latest master

DockerENT has been designed to keep simplicity and usability in mind. Currently you just have to clone the repository and download dependencies or build the Dockerfile. Once the dependencies are installed in local system we are good to run the tool and analyse the runtime configurations for running containers.

# Download and setup
git clone
cd DockerENT
make venv
source venv/bin/activate

# Run
python -m DockerENT --help 
usage: Find the vulnerabilities hidden in your running container(s).
       [-h] [-d [DOCKER_CONTAINER]] [-p [DOCKER_PLUGINS]]
       [-d-nw [DOCKER_NETWORK]] [-p-nw [DOCKER_NW_PLUGINS]] [-w]
       [-n [PROCESS_COUNT]] [-a] [-o [OUTPUT]]

optional arguments:
  -h, --help            show this help message and exit
  -w, --web-app         Run DockerENT in WebApp mode. If this parameter is
                        enabled, other command line flags will be ignored.
                        Run scans in parallel (Process pool count).
  -a, --audit           Flag to check weather to audit results or not.

                        Run scan against the running container.
                        Run scan with only specified plugins.
  -p-nw [DOCKER_NW_PLUGINS], --nw-plugins [DOCKER_NW_PLUGINS]
                        Run scan with only specified plugins.

  -d-nw [DOCKER_NETWORK], --docker-network [DOCKER_NETWORK]
                        Run scan against running docker-network.

  -o [OUTPUT], --output [OUTPUT]
                        Output plugin to write data to.

# or via the container
docker build . -t dockerent
docker run -d -v /var/run/docker.sock:/var/run/docker.sock -p 8501:8501 --name dockerent dockerent
# Then just open your browser to http://localhost:8051

See this quick video to get started with.


How to Create your own Plugin.

cp DockerENT/docker_plugins/ DockerENT/docker_plugins/
_plugin_name = 'demo_plugin'

def scan(container, output_queue, audit=False, audit_queue=None):'Staring {} Plugin ...'.format(_plugin_name_))

    res = {}

    result = {
        'test_class': {
            'TEST_NAME': ['good']

    res[container.short_id] = {
        _plugin_name_: result
    # Do something magical.'Completed execution of {} Plugin.'.format(_plugin_name_))

    '''Make Sure you put dict of following structure in Q.
        'contiainer_id': {
            'plugin_name': {
                'test_name_demo1': {
                'test_name_demo2': {
                    results: []

    if audit:
        _audit(container, res, audit_queue)

def _audit(container, results, audit_queue):
    '''Make Sure to add dict of following structure to Audit Q
    res = {
        "container_id": [
            "_plugin_name_, WARN/INFO/ERROR, details"
    # Magical logic to perform Audit.

Plugins Features:

Plugin Name Plugin File Feature Audit
CMD_HISTORY File Identify shell history Root history and User shell history
FILESYSTEM File Identify RW File Systems If RW file systems are present.
NETWORK File Identify Network state Identifies All mapped ports.
PLAINTEST_PASSWORD File Identify password in different files
SECURITY_PROFILES File Identify Weak Security Profiles List Weak security profiles.
USER_INFO File Identify user info List permissions in passwd and other sensitive files
SYSTEM_INFO File Identify docker system info No Audit
FILES_INFO File Identify world writeable directories and files List all such files.
PROC_INFO File Identify the list of process in docker system

CLI interface