CIS
The Center for Internet Security (CIS) provides prescriptive configuration recommendations for a variety of software vendors. Anchore Enterprise’s CIS policy pack is based on the CIS Docker 1.8 Benchmark and validates a subset of security and compliance checks against container images.
Current CIS policy pack version: Anchore CIS Docker Benchmark V1.8.0 v2026.1
Introduction
The Center for Internet Security is a nonprofit that publishes consensus-developed configuration baselines, the CIS Benchmarks, for operating systems, cloud platforms, and container runtimes. They are widely used as the reference hardening standard in audits and contracts, and other frameworks frequently point at them rather than restating the same configuration guidance.
The Docker Benchmark is organized by where a control applies: host configuration, daemon configuration and files, container images and build files (section 4), container runtime (section 5), and security operations. This pack implements the section 4 controls, which are evaluated against image and Dockerfile content, plus 5.8 on privileged port mapping. The host, daemon, and runtime sections describe the machine a container runs on rather than the artifact itself and are out of scope for an image policy.
Controls
Anchore Enterprise checks for the following control specifications in the CIS policy. Rule sets marked Required in the Configuration column must be configured for your environment before the policy is used. See Configure Rule Sets.
| Control | Check | Configuration |
|---|---|---|
| 4.1 | Ensure that a user for the container has been created | |
| 4.2 | Ensure that containers use only trusted base images | Required |
| 4.3 | Ensure that unnecessary packages are not installed in the container | Required |
| 4.4 | Ensure images are scanned and rebuilt to include security patches. Fails on vulnerabilities with a fix available, on unavailable vulnerability data, and when the feed has not synced in 4 days | |
| 4.6 | Ensure that HEALTHCHECK instructions have been added to container images | |
| 4.7 | Ensure update instructions are not used alone in Dockerfiles | |
| 4.8 | Ensure setuid and setgid permissions are removed | |
| 4.9 | Ensure that COPY is used instead of ADD in Dockerfiles | |
| 4.10 | Ensure secrets are not stored in Dockerfiles | |
| 5.8 | Ensure privileged ports are not mapped within containers | Required |
Use the Pack
Import the pack like any other policy. See Manage Policies for the GUI, AnchoreCTL, and API workflows. Once imported, scope it to the registries and repositories it should apply to through Policy Mappings, then activate it as the account’s default policy.
Configure Rule Sets
The control specifications marked Required in the table above need configuration for your environment. The control specifications are represented by rule sets, edited from the policy’s Edit action in the Anchore Enterprise GUI (see Manage Policies).
Last modified September 22, 2026