Not far behind is the open documentation for the military, DISA STIGs, for Linux and Unix environments. Not sure they have anything for Docker yet unless you co

Not far behind is the open documentation for the military, DISA STIGs, for Linux and Unix environments. Not sure they have anything for Docker yet unless you count treating each container like a vanilla Linux or Unix box, and many here know that only gets you so far if you don't understand container system hardening; even CIS controls specific to Docker here are a surprise to me as someone who deployed them for traditional platforms in years past. From experience there is a lot of overlap between both for OS management. The templates and documentation for DoD stuff does not require email signups for PDFs or an expensive org membership for GPO templates for Windows and other nonsense, unlike SANS-affiliated CIS. https://iase.disa.mil/stigs/Pages/index.aspx https://iase.disa.mil/stigs/Pages/index.aspx https://www.open-scap.org/resources/documentation/security-compliance-of-rhel7-docker-containers/ https://www.open-scap.org/resources/documentation/security-c... Either way, blindly taking these policies, or from a vendor like Calvirin, who I'm sure are good, is a recipe for disaster when you and/or fellow admins do not review all hundreds of controls and know your environment very well, if previous life experience taught me anything.