Apart from auditing your regular Linux file system and system calls, audit all Docker related files and directories. Docker daemon runs with root privileges. Its behavior depends on some key files and directories. /etc/docker is one such directory. It holds various certificates and keys used for TLS communication between Docker daemon and Docker client. It must be audited.
SolutionAdd a rule for /etc/docker directory.
Add the line as below in /etc/audit/audit.rules file:
-w /etc/docker -k docker
Then, restart the audit daemon. For example,
service auditd restart
Auditing generates quite big log files. Ensure to rotate and archive them periodically. Also, create a separate partition of audit to avoid filling root file system.
By default, Docker related files and directories are not audited.