Which tools are specifically used to scan container configurations in Docker and Kubernetes environments?

• A. Nmap and OpenVAS
• B. Nessus and Burp Suite
• C. Docker Bench and Kube-hunter
• D. Metasploit and Cobalt Strike

Answer: (C)

Container security configuration is about auditing how Docker and Kubernetes are set up and run, ensuring they follow best practices and aren’t exposing risky surfaces. Docker Bench for Security evaluates a Docker host against the CIS Docker Benchmark, checking daemon flags, container capabilities, isolation mechanisms (like seccomp and AppArmor/SELinux), logging, and other host-level controls. Kube-hunter looks for misconfigurations and exposures within a Kubernetes cluster, such as open API endpoints, weak RBAC, leaked tokens, and insecure network or add-on settings. Together, they provide targeted checks for container environments rather than general vulnerability scanning.

Other tools mentioned are broader in scope: general network scanners or host scanners won’t specifically verify container configurations, and exploitation frameworks aren’t designed to assess configuration hardening.