vamp-docker-audit 1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. vamp_docker_audit-1.0/PKG-INFO +160 -0
  2. vamp_docker_audit-1.0/README.md +140 -0
  3. vamp_docker_audit-1.0/pyproject.toml +36 -0
  4. vamp_docker_audit-1.0/setup.cfg +4 -0
  5. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/PKG-INFO +160 -0
  6. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/SOURCES.txt +10 -0
  7. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/dependency_links.txt +1 -0
  8. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/entry_points.txt +2 -0
  9. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/requires.txt +1 -0
  10. vamp_docker_audit-1.0/vamp_docker_audit.egg-info/top_level.txt +2 -0
  11. vamp_docker_audit-1.0/vamp_docker_audit.py +1758 -0
  12. vamp_docker_audit-1.0/vampsec_report.py +959 -0
vamp_docker_audit-1.0/PKG-INFO ADDED
@@ -0,0 +1,160 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-docker-audit
3
+ Version: 1.0
4
+ Summary: Docker/container security auditor for authorized assessments
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-docker-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-docker-audit
9
+ Keywords: security,pentest,audit,cybersecurity,vampsecure,docker,container,kubernetes,devsecops
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Requires-Python: >=3.9
18
+ Description-Content-Type: text/markdown
19
+ Requires-Dist: rich>=13.7.0
20
+
21
+ <h1 align="center">vamp-docker-audit</h1>
22
+
23
+ <p align="center">
24
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
25
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
26
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
27
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
28
+ </p>
29
+
30
+ ## Overview
31
+
32
+ `vamp-docker-audit` is a CIS Docker Benchmark-aligned security auditor that inspects running Docker containers, their environment variables, images, networks, and volumes for misconfigurations and credential exposure. It operates entirely through the Docker CLI — no SDK dependency — making it portable across any Docker-capable host. A multi-phase architecture covers daemon access verification, per-container security checks, secret detection in environment variables, image freshness, and network driver analysis, with findings rated CRITICAL to INFO and exported to Console, JSON, or HTML.
33
+
34
+ ## Features
35
+
36
+ - Phase 0: daemon access verification and Docker socket permission check (`/var/run/docker.sock` ownership and mode)
37
+ - Container checks (DOCK-001 to DOCK-010): privileged mode (CRITICAL), dangerous Linux capabilities including `CAP_SYS_ADMIN`, `CAP_NET_ADMIN`, `CAP_SYS_PTRACE` (HIGH), root user inside container (MEDIUM), Docker socket mounted inside container (CRITICAL), host network mode (HIGH), sensitive bind mounts (`/etc`, `/var/run`, `/proc`, `/sys`, `/root`, `/home`) (MEDIUM), host PID namespace (HIGH), host IPC namespace (MEDIUM), unlimited restart policy (INFO), ports bound to `0.0.0.0` (LOW)
38
+ - Environment variable secret scanning: variable names matching `PASSWORD`, `PASSWD`, `SECRET`, `TOKEN`, `KEY`, `API_KEY`, `APIKEY`, `PRIVATE`, `CREDENTIALS`, `AUTH`, `DSN` (HIGH); value patterns for `sk_`/`pk_`, `ghp_`, `glpat-`, `xox[bpoa]-`, `Bearer`, `AKIA...`, `ey...`, base64-encoded blobs (HIGH); connection string variables `DATABASE_URL`, `MONGO_URL`, `REDIS_URL` and variants (MEDIUM)
39
+ - Image checks: `:latest` or `<none>` tag (LOW), images older than 90 days (INFO)
40
+ - Network analysis: host-driver network inventory (INFO)
41
+ - Volume inventory (INFO)
42
+ - Selective container targeting with `--containers` (comma-separated names or IDs) or full-fleet scan
43
+ - Stopped container inclusion with `--include-stopped`
44
+ - ENV scan bypass with `--no-env-scan` for privacy-sensitive environments
45
+ - Custom Docker socket path via `--socket`
46
+ - Export to Console (Rich per-container panels), JSON, and HTML (dark-theme)
47
+
48
+ ## Requirements
49
+
50
+ - Python 3.9 or later
51
+ - `rich >= 13.7.0`
52
+ - Docker CLI in `PATH` and a running Docker daemon
53
+ - Optional: `fpdf2 >= 2.7` for `--report-pdf`
54
+
55
+ ## Installation
56
+
57
+ ```bash
58
+ git clone https://github.com/belky-me/vamp-docker-audit.git
59
+ cd vamp-docker-audit
60
+ python3 -m venv .venv
61
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
62
+ pip install -r requirements.txt
63
+ ```
64
+
65
+ ## Usage
66
+
67
+ ```
68
+ python3 vamp_docker_audit.py --help
69
+ ```
70
+
71
+ ```
72
+ usage: vamp_docker_audit.py [-h]
73
+ [--socket PATH]
74
+ [--containers NAMES]
75
+ [--include-stopped]
76
+ [--no-env-scan]
77
+ [--json FILE] [--html FILE]
78
+ [--client CLIENT] [--engagement ENGAGEMENT]
79
+ [--auditor AUDITOR] [--report-scope SCOPE]
80
+ [--report-html FILE] [--report-pdf FILE]
81
+
82
+ vamp-docker-audit — Docker Security Auditor (VampSecure Labs)
83
+ ```
84
+
85
+ ## Examples
86
+
87
+ ```bash
88
+ # Audit all running containers on the local host
89
+ python3 vamp_docker_audit.py
90
+
91
+ # Audit specific containers by name
92
+ python3 vamp_docker_audit.py --containers web,api,db
93
+
94
+ # Include stopped containers in the audit
95
+ python3 vamp_docker_audit.py --include-stopped
96
+
97
+ # Audit without ENV variable secret scanning
98
+ python3 vamp_docker_audit.py --no-env-scan
99
+
100
+ # Use a non-standard Docker socket (e.g. rootless Docker)
101
+ python3 vamp_docker_audit.py --socket /run/user/1000/docker.sock
102
+
103
+ # Export findings to JSON and HTML
104
+ python3 vamp_docker_audit.py --json results.json --html report.html
105
+
106
+ # Generate client-ready engagement report (HTML + PDF)
107
+ python3 vamp_docker_audit.py \
108
+ --client "Acme Corp" --engagement "Container Security Review Q3 2026" \
109
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
110
+ ```
111
+
112
+ ## CLI Reference
113
+
114
+ | Flag | Default | Description |
115
+ |------|---------|-------------|
116
+ | `--socket PATH` | `/var/run/docker.sock` | Path to Docker socket |
117
+ | `--containers NAMES` | all running | Comma-separated container names or IDs to target |
118
+ | `--include-stopped` | off | Include stopped containers in the audit |
119
+ | `--no-env-scan` | off | Skip environment variable secret scanning |
120
+ | `--json FILE` | — | Export results to JSON |
121
+ | `--html FILE` | — | Export dark-theme HTML report |
122
+ | `--client TEXT` | — | Client name for VSL engagement report |
123
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
124
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
125
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
126
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
127
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
128
+
129
+ ## Output Formats
130
+
131
+ | Format | Flag | Description |
132
+ |--------|------|-------------|
133
+ | Console | (default) | Rich panels per container with color-coded findings by severity |
134
+ | JSON | `--json FILE` | Machine-readable full result set |
135
+ | HTML | `--html FILE` | Dark-theme standalone report |
136
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
137
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
138
+
139
+ ## Exit Codes
140
+
141
+ | Code | Meaning | CI/CD Behavior |
142
+ |------|---------|----------------|
143
+ | `0` | No critical or high findings | Pipeline passes |
144
+ | `1` | High-severity findings detected | Pipeline fails — review required |
145
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
146
+
147
+ ## Legal Notice
148
+
149
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
150
+
151
+ ## Part of VampSecure Labs Toolkit
152
+
153
+ `vamp-docker-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
154
+
155
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
156
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
157
+
158
+ ---
159
+
160
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_docker_audit-1.0/README.md ADDED
@@ -0,0 +1,140 @@
1
+ <h1 align="center">vamp-docker-audit</h1>
2
+
3
+ <p align="center">
4
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
5
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
6
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
7
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
8
+ </p>
9
+
10
+ ## Overview
11
+
12
+ `vamp-docker-audit` is a CIS Docker Benchmark-aligned security auditor that inspects running Docker containers, their environment variables, images, networks, and volumes for misconfigurations and credential exposure. It operates entirely through the Docker CLI — no SDK dependency — making it portable across any Docker-capable host. A multi-phase architecture covers daemon access verification, per-container security checks, secret detection in environment variables, image freshness, and network driver analysis, with findings rated CRITICAL to INFO and exported to Console, JSON, or HTML.
13
+
14
+ ## Features
15
+
16
+ - Phase 0: daemon access verification and Docker socket permission check (`/var/run/docker.sock` ownership and mode)
17
+ - Container checks (DOCK-001 to DOCK-010): privileged mode (CRITICAL), dangerous Linux capabilities including `CAP_SYS_ADMIN`, `CAP_NET_ADMIN`, `CAP_SYS_PTRACE` (HIGH), root user inside container (MEDIUM), Docker socket mounted inside container (CRITICAL), host network mode (HIGH), sensitive bind mounts (`/etc`, `/var/run`, `/proc`, `/sys`, `/root`, `/home`) (MEDIUM), host PID namespace (HIGH), host IPC namespace (MEDIUM), unlimited restart policy (INFO), ports bound to `0.0.0.0` (LOW)
18
+ - Environment variable secret scanning: variable names matching `PASSWORD`, `PASSWD`, `SECRET`, `TOKEN`, `KEY`, `API_KEY`, `APIKEY`, `PRIVATE`, `CREDENTIALS`, `AUTH`, `DSN` (HIGH); value patterns for `sk_`/`pk_`, `ghp_`, `glpat-`, `xox[bpoa]-`, `Bearer`, `AKIA...`, `ey...`, base64-encoded blobs (HIGH); connection string variables `DATABASE_URL`, `MONGO_URL`, `REDIS_URL` and variants (MEDIUM)
19
+ - Image checks: `:latest` or `<none>` tag (LOW), images older than 90 days (INFO)
20
+ - Network analysis: host-driver network inventory (INFO)
21
+ - Volume inventory (INFO)
22
+ - Selective container targeting with `--containers` (comma-separated names or IDs) or full-fleet scan
23
+ - Stopped container inclusion with `--include-stopped`
24
+ - ENV scan bypass with `--no-env-scan` for privacy-sensitive environments
25
+ - Custom Docker socket path via `--socket`
26
+ - Export to Console (Rich per-container panels), JSON, and HTML (dark-theme)
27
+
28
+ ## Requirements
29
+
30
+ - Python 3.9 or later
31
+ - `rich >= 13.7.0`
32
+ - Docker CLI in `PATH` and a running Docker daemon
33
+ - Optional: `fpdf2 >= 2.7` for `--report-pdf`
34
+
35
+ ## Installation
36
+
37
+ ```bash
38
+ git clone https://github.com/belky-me/vamp-docker-audit.git
39
+ cd vamp-docker-audit
40
+ python3 -m venv .venv
41
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
42
+ pip install -r requirements.txt
43
+ ```
44
+
45
+ ## Usage
46
+
47
+ ```
48
+ python3 vamp_docker_audit.py --help
49
+ ```
50
+
51
+ ```
52
+ usage: vamp_docker_audit.py [-h]
53
+ [--socket PATH]
54
+ [--containers NAMES]
55
+ [--include-stopped]
56
+ [--no-env-scan]
57
+ [--json FILE] [--html FILE]
58
+ [--client CLIENT] [--engagement ENGAGEMENT]
59
+ [--auditor AUDITOR] [--report-scope SCOPE]
60
+ [--report-html FILE] [--report-pdf FILE]
61
+
62
+ vamp-docker-audit — Docker Security Auditor (VampSecure Labs)
63
+ ```
64
+
65
+ ## Examples
66
+
67
+ ```bash
68
+ # Audit all running containers on the local host
69
+ python3 vamp_docker_audit.py
70
+
71
+ # Audit specific containers by name
72
+ python3 vamp_docker_audit.py --containers web,api,db
73
+
74
+ # Include stopped containers in the audit
75
+ python3 vamp_docker_audit.py --include-stopped
76
+
77
+ # Audit without ENV variable secret scanning
78
+ python3 vamp_docker_audit.py --no-env-scan
79
+
80
+ # Use a non-standard Docker socket (e.g. rootless Docker)
81
+ python3 vamp_docker_audit.py --socket /run/user/1000/docker.sock
82
+
83
+ # Export findings to JSON and HTML
84
+ python3 vamp_docker_audit.py --json results.json --html report.html
85
+
86
+ # Generate client-ready engagement report (HTML + PDF)
87
+ python3 vamp_docker_audit.py \
88
+ --client "Acme Corp" --engagement "Container Security Review Q3 2026" \
89
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
90
+ ```
91
+
92
+ ## CLI Reference
93
+
94
+ | Flag | Default | Description |
95
+ |------|---------|-------------|
96
+ | `--socket PATH` | `/var/run/docker.sock` | Path to Docker socket |
97
+ | `--containers NAMES` | all running | Comma-separated container names or IDs to target |
98
+ | `--include-stopped` | off | Include stopped containers in the audit |
99
+ | `--no-env-scan` | off | Skip environment variable secret scanning |
100
+ | `--json FILE` | — | Export results to JSON |
101
+ | `--html FILE` | — | Export dark-theme HTML report |
102
+ | `--client TEXT` | — | Client name for VSL engagement report |
103
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
104
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
105
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
106
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
107
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
108
+
109
+ ## Output Formats
110
+
111
+ | Format | Flag | Description |
112
+ |--------|------|-------------|
113
+ | Console | (default) | Rich panels per container with color-coded findings by severity |
114
+ | JSON | `--json FILE` | Machine-readable full result set |
115
+ | HTML | `--html FILE` | Dark-theme standalone report |
116
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
117
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
118
+
119
+ ## Exit Codes
120
+
121
+ | Code | Meaning | CI/CD Behavior |
122
+ |------|---------|----------------|
123
+ | `0` | No critical or high findings | Pipeline passes |
124
+ | `1` | High-severity findings detected | Pipeline fails — review required |
125
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
126
+
127
+ ## Legal Notice
128
+
129
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
130
+
131
+ ## Part of VampSecure Labs Toolkit
132
+
133
+ `vamp-docker-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
134
+
135
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
136
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
137
+
138
+ ---
139
+
140
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_docker_audit-1.0/pyproject.toml ADDED
@@ -0,0 +1,36 @@
1
+ [build-system]
2
+ requires = ["setuptools>=68", "wheel"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "vamp-docker-audit"
7
+ version = "1.0"
8
+ description = "Docker/container security auditor for authorized assessments"
9
+ readme = "README.md"
10
+ license = { text = "MIT" }
11
+ requires-python = ">=3.9"
12
+ authors = [{ name = "VampSecure Studios", email = "contact@vampsecurestudios.com" }]
13
+ keywords = ["security", "pentest", "audit", "cybersecurity", "vampsecure", "docker", "container", "kubernetes", "devsecops"]
14
+ classifiers = [
15
+ "Development Status :: 5 - Production/Stable",
16
+ "Environment :: Console",
17
+ "Intended Audience :: Information Technology",
18
+ "License :: OSI Approved :: MIT License",
19
+ "Operating System :: OS Independent",
20
+ "Programming Language :: Python :: 3",
21
+ "Topic :: Security",
22
+ ]
23
+ dependencies = [
24
+ "rich>=13.7.0",
25
+ ]
26
+
27
+
28
+ [project.scripts]
29
+ vamp-docker-audit = "vamp_docker_audit:main"
30
+
31
+ [project.urls]
32
+ Homepage = "https://github.com/Vampsecure-Labs/vamp-docker-audit"
33
+ Repository = "https://github.com/Vampsecure-Labs/vamp-docker-audit"
34
+
35
+ [tool.setuptools]
36
+ py-modules = ["vamp_docker_audit", "vampsec_report"]
vamp_docker_audit-1.0/setup.cfg ADDED
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+
vamp_docker_audit-1.0/vamp_docker_audit.egg-info/PKG-INFO ADDED
@@ -0,0 +1,160 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-docker-audit
3
+ Version: 1.0
4
+ Summary: Docker/container security auditor for authorized assessments
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-docker-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-docker-audit
9
+ Keywords: security,pentest,audit,cybersecurity,vampsecure,docker,container,kubernetes,devsecops
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Requires-Python: >=3.9
18
+ Description-Content-Type: text/markdown
19
+ Requires-Dist: rich>=13.7.0
20
+
21
+ <h1 align="center">vamp-docker-audit</h1>
22
+
23
+ <p align="center">
24
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
25
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
26
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
27
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
28
+ </p>
29
+
30
+ ## Overview
31
+
32
+ `vamp-docker-audit` is a CIS Docker Benchmark-aligned security auditor that inspects running Docker containers, their environment variables, images, networks, and volumes for misconfigurations and credential exposure. It operates entirely through the Docker CLI — no SDK dependency — making it portable across any Docker-capable host. A multi-phase architecture covers daemon access verification, per-container security checks, secret detection in environment variables, image freshness, and network driver analysis, with findings rated CRITICAL to INFO and exported to Console, JSON, or HTML.
33
+
34
+ ## Features
35
+
36
+ - Phase 0: daemon access verification and Docker socket permission check (`/var/run/docker.sock` ownership and mode)
37
+ - Container checks (DOCK-001 to DOCK-010): privileged mode (CRITICAL), dangerous Linux capabilities including `CAP_SYS_ADMIN`, `CAP_NET_ADMIN`, `CAP_SYS_PTRACE` (HIGH), root user inside container (MEDIUM), Docker socket mounted inside container (CRITICAL), host network mode (HIGH), sensitive bind mounts (`/etc`, `/var/run`, `/proc`, `/sys`, `/root`, `/home`) (MEDIUM), host PID namespace (HIGH), host IPC namespace (MEDIUM), unlimited restart policy (INFO), ports bound to `0.0.0.0` (LOW)
38
+ - Environment variable secret scanning: variable names matching `PASSWORD`, `PASSWD`, `SECRET`, `TOKEN`, `KEY`, `API_KEY`, `APIKEY`, `PRIVATE`, `CREDENTIALS`, `AUTH`, `DSN` (HIGH); value patterns for `sk_`/`pk_`, `ghp_`, `glpat-`, `xox[bpoa]-`, `Bearer`, `AKIA...`, `ey...`, base64-encoded blobs (HIGH); connection string variables `DATABASE_URL`, `MONGO_URL`, `REDIS_URL` and variants (MEDIUM)
39
+ - Image checks: `:latest` or `<none>` tag (LOW), images older than 90 days (INFO)
40
+ - Network analysis: host-driver network inventory (INFO)
41
+ - Volume inventory (INFO)
42
+ - Selective container targeting with `--containers` (comma-separated names or IDs) or full-fleet scan
43
+ - Stopped container inclusion with `--include-stopped`
44
+ - ENV scan bypass with `--no-env-scan` for privacy-sensitive environments
45
+ - Custom Docker socket path via `--socket`
46
+ - Export to Console (Rich per-container panels), JSON, and HTML (dark-theme)
47
+
48
+ ## Requirements
49
+
50
+ - Python 3.9 or later
51
+ - `rich >= 13.7.0`
52
+ - Docker CLI in `PATH` and a running Docker daemon
53
+ - Optional: `fpdf2 >= 2.7` for `--report-pdf`
54
+
55
+ ## Installation
56
+
57
+ ```bash
58
+ git clone https://github.com/belky-me/vamp-docker-audit.git
59
+ cd vamp-docker-audit
60
+ python3 -m venv .venv
61
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
62
+ pip install -r requirements.txt
63
+ ```
64
+
65
+ ## Usage
66
+
67
+ ```
68
+ python3 vamp_docker_audit.py --help
69
+ ```
70
+
71
+ ```
72
+ usage: vamp_docker_audit.py [-h]
73
+ [--socket PATH]
74
+ [--containers NAMES]
75
+ [--include-stopped]
76
+ [--no-env-scan]
77
+ [--json FILE] [--html FILE]
78
+ [--client CLIENT] [--engagement ENGAGEMENT]
79
+ [--auditor AUDITOR] [--report-scope SCOPE]
80
+ [--report-html FILE] [--report-pdf FILE]
81
+
82
+ vamp-docker-audit — Docker Security Auditor (VampSecure Labs)
83
+ ```
84
+
85
+ ## Examples
86
+
87
+ ```bash
88
+ # Audit all running containers on the local host
89
+ python3 vamp_docker_audit.py
90
+
91
+ # Audit specific containers by name
92
+ python3 vamp_docker_audit.py --containers web,api,db
93
+
94
+ # Include stopped containers in the audit
95
+ python3 vamp_docker_audit.py --include-stopped
96
+
97
+ # Audit without ENV variable secret scanning
98
+ python3 vamp_docker_audit.py --no-env-scan
99
+
100
+ # Use a non-standard Docker socket (e.g. rootless Docker)
101
+ python3 vamp_docker_audit.py --socket /run/user/1000/docker.sock
102
+
103
+ # Export findings to JSON and HTML
104
+ python3 vamp_docker_audit.py --json results.json --html report.html
105
+
106
+ # Generate client-ready engagement report (HTML + PDF)
107
+ python3 vamp_docker_audit.py \
108
+ --client "Acme Corp" --engagement "Container Security Review Q3 2026" \
109
+ --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf
110
+ ```
111
+
112
+ ## CLI Reference
113
+
114
+ | Flag | Default | Description |
115
+ |------|---------|-------------|
116
+ | `--socket PATH` | `/var/run/docker.sock` | Path to Docker socket |
117
+ | `--containers NAMES` | all running | Comma-separated container names or IDs to target |
118
+ | `--include-stopped` | off | Include stopped containers in the audit |
119
+ | `--no-env-scan` | off | Skip environment variable secret scanning |
120
+ | `--json FILE` | — | Export results to JSON |
121
+ | `--html FILE` | — | Export dark-theme HTML report |
122
+ | `--client TEXT` | — | Client name for VSL engagement report |
123
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
124
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
125
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
126
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
127
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
128
+
129
+ ## Output Formats
130
+
131
+ | Format | Flag | Description |
132
+ |--------|------|-------------|
133
+ | Console | (default) | Rich panels per container with color-coded findings by severity |
134
+ | JSON | `--json FILE` | Machine-readable full result set |
135
+ | HTML | `--html FILE` | Dark-theme standalone report |
136
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
137
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
138
+
139
+ ## Exit Codes
140
+
141
+ | Code | Meaning | CI/CD Behavior |
142
+ |------|---------|----------------|
143
+ | `0` | No critical or high findings | Pipeline passes |
144
+ | `1` | High-severity findings detected | Pipeline fails — review required |
145
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
146
+
147
+ ## Legal Notice
148
+
149
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
150
+
151
+ ## Part of VampSecure Labs Toolkit
152
+
153
+ `vamp-docker-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
154
+
155
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
156
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
157
+
158
+ ---
159
+
160
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_docker_audit-1.0/vamp_docker_audit.egg-info/SOURCES.txt ADDED
@@ -0,0 +1,10 @@
1
+ README.md
2
+ pyproject.toml
3
+ vamp_docker_audit.py
4
+ vampsec_report.py
5
+ vamp_docker_audit.egg-info/PKG-INFO
6
+ vamp_docker_audit.egg-info/SOURCES.txt
7
+ vamp_docker_audit.egg-info/dependency_links.txt
8
+ vamp_docker_audit.egg-info/entry_points.txt
9
+ vamp_docker_audit.egg-info/requires.txt
10
+ vamp_docker_audit.egg-info/top_level.txt
vamp_docker_audit-1.0/vamp_docker_audit.egg-info/entry_points.txt ADDED
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ vamp-docker-audit = vamp_docker_audit:main
vamp_docker_audit-1.0/vamp_docker_audit.egg-info/requires.txt ADDED
@@ -0,0 +1 @@
1
+ rich>=13.7.0
vamp_docker_audit-1.0/vamp_docker_audit.egg-info/top_level.txt ADDED
@@ -0,0 +1,2 @@
1
+ vamp_docker_audit
2
+ vampsec_report