WheInfosec / Docker Security Assessment

Secure the image. Constrain the runtime.

Review Docker images, build configuration, and runtime permissions to understand container-related security risks.

What we assess

Dockerfile practices, image provenance, and dependency exposure
Runtime users, Linux capabilities, and privileged mode
Daemon access, socket mounts, and host filesystem exposure
Secrets handling, network exposure, and resource constraints

What you receive

Prioritized findings with evidence, scope limitations, practical fixes, and an agreed retesting plan. Manual validation adds context to tool output.

Risk-informed assessment

Relevant OWASP Top 10:2025 themes

These web application themes provide context for containerized workloads; they are not a Docker-specific Top 10. Docker configuration, image, daemon, and runtime checks are assessed separately.

A01

Access control failures

A02

Unsafe security configuration

A03

Software supply-chain weaknesses

A04

Cryptographic weaknesses

A05

Injection risks

A06

Insecure application design

A07

Authentication weaknesses

A08

Untrusted software or data integrity

A09

Missing security logs and alerts

A10

Unsafe handling of exceptional conditions

Risk themes summarized from the official OWASP list ↗. Applicability is confirmed during scoping. This is not OWASP certification or a claim that every category has been tested.

See the deliverable

A closer look at the report.

Four-page PDF with a fictional finding, example evidence, and a retest plan. Not a real client assessment.

Download sample PDF ↓Public sample · 4 pages