Merge pull request #115 from wmedlar/feature/running-in-docker

Allow kube-bench to be run from inside its container

Dockerfile

@@ -1,13 +1,22 @@
-FROM golang:1.9
+FROM golang:1.9 AS build
-WORKDIR /kube-bench
+WORKDIR /go/src/github.com/aquasecurity/kube-bench/
-RUN go get github.com/aquasecurity/kube-bench
+ADD glide.lock glide.yaml ./
+RUN go get github.com/Masterminds/glide && glide install
+ADD main.go .
+ADD check/ check/
+ADD cmd/ cmd/
+RUN CGO_ENABLED=0 go install -a -ldflags '-w'
 
-FROM alpine:latest
+FROM alpine:3.7 AS run
-WORKDIR /
+WORKDIR /opt/kube-bench/
-COPY --from=0 /go/bin/kube-bench /kube-bench 
+# add GNU ps for -C, -o cmd, and --no-headers support
-COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/cfg /cfg
+# https://github.com/aquasecurity/kube-bench/issues/109
-COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/entrypoint.sh /entrypoint.sh
+RUN apk --no-cache add procps
-ENTRYPOINT /entrypoint.sh
+COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
+ADD entrypoint.sh .
+ADD cfg/ cfg/
+ENTRYPOINT ["./entrypoint.sh"]
+CMD ["install"]
 
 # Build-time metadata as defined at http://label-schema.org
 ARG BUILD_DATE

README.md

@@ -19,10 +19,31 @@ kube-bench supports the tests for multiple versions of Kubernetes (1.6, 1.7 and
 
 You can either install kube-bench through a dedicated container, or compile it from source:
 
-1. Container installation:
+### Running inside a container
-Run ```docker run --rm -v `pwd`:/host aquasec/kube-bench:latest```. This will copy the kube-bench binary and configuration to you host. You can then run ```./kube-bench <master|node>```.
+
+You can avoid installing kube-bench entirely by running it inside a container using the host PID namespace.
+
+```
+docker run --pid=host aquasec/kube-bench:latest <master|node>
+```
+
+You can even use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`
+
+```
+docker run --pid=host -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yaml aquasec/kube-bench:latest <master|node>
+```
+
+### Installing from a container
+
+If you want to install a pre-built kube-bench, you can copy the kube-bench binary and configuration files to your host from the Docker container:
+```
+docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install
+```
+
+You can then run `./kube-bench <master|node>`. This should work for any Linux distribution, including Alpine.
+
+### Installing from sources
 
-2. Install from sources:
 If Go is installed on the target machines, you can simply clone this repository and run as follows (assuming your [$GOPATH is set](https://github.com/golang/go/wiki/GOPATH)):
 
 ```go get github.com/aquasecurity/kube-bench

entrypoint.sh

@@ -1,14 +1,19 @@
 #!/bin/sh
-if [ -d /host ]; then
+if [ "$1" == "install" ]; then
-  mkdir -p /host/cfg/
+  if [ -d /host ]; then
-  yes | cp -rf /cfg/* /host/cfg/
+    mkdir -p /host/cfg/
-  yes | cp -rf /kube-bench /host/
+    yes | cp -rf /cfg/* /host/cfg/
-  echo "==============================================="
+    yes | cp -rf /kube-bench /host/
-  echo "kube-bench is now installed on your host       "
+    echo "==============================================="
-  echo "Run ./kube-bench to perform a security check   "
+    echo "kube-bench is now installed on your host       "
-  echo "==============================================="
+    echo "Run ./kube-bench to perform a security check   "
+    echo "==============================================="
+  else
+    echo "Usage:"
+    echo "  install: docker run --rm -v \`pwd\`:/host aquasec/kube-bench install"
+    echo "  run:     docker run --rm --pid=host aquasec/kube-bench [command]"
+    exit
+  fi
 else
-  echo "Usage:"
+  exec kube-bench "$@"
-  echo "  docker run --rm -v \`pwd\`:/host aquasec/kube-bench"
-  exit 
 fi