How do I run the CIS Docker Benchmark?

More context

The daemon configuration section deserves priority because daemon-level mistakes affect every container on the host: an exposed or unprotected daemon socket, permissive default privileges, or missing logging undermine controls applied per-container. Host hardening comes next, since container isolation is only as strong as the kernel and file permissions beneath it.

Image and runtime checks are where drift accumulates fastest, because new images ship and containers restart continuously. Continuous benchmark scanning with drift detection catches a privileged container or an untrusted base image when it appears rather than at the next audit, and CISGuard maps each scan result to NIST 800-53, ISO 27001, and SOC 2 automatically.