{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "docker-cli",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "The client created a context, parsed one synthetic container from a localhost API fixture and refused TLS setup without its CA file. No Docker Engine or container isolation was tested.",
    "identity": {
      "version": "29.9.1 (build dfc520d)",
      "target": "Official Docker Windows static client archive",
      "integrity": "SHA-256 5d9b66509390553fd97d590ec2ff0ce10b04c2ac653fa52f2abf2f05c4c197ca of the official downloaded docker.zip artifact."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.",
      "Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in.",
      "No daemon/service was installed or started. Only the downloaded docker.exe client ran."
    ],
    "checks": [
      {
        "id": "docker-cli-version",
        "name": "Downloaded version",
        "method": "<evaluation>\\downloads\\cli\\docker\\docker\\docker.exe --version",
        "expected": "Print the client version.",
        "observed": "Exit 0. Docker version 29.9.1, build dfc520d",
        "outcome": "pass"
      },
      {
        "id": "docker-cli-context-create-rerun",
        "name": "Create isolated daemon context",
        "method": "<evaluation>\\downloads\\cli\\docker\\docker\\docker.exe context create ionbin-local-fixture-57373 --docker host=tcp://127.0.0.1:57373",
        "expected": "Store the synthetic loopback endpoint.",
        "observed": "Exit 0. ionbin-local-fixture-57373\nSuccessfully created context \"ionbin-local-fixture-57373\"",
        "outcome": "pass"
      },
      {
        "id": "docker-cli-loopback-list-rerun",
        "name": "Read a synthetic container listing",
        "method": "<evaluation>\\downloads\\cli\\docker\\docker\\docker.exe --context ionbin-local-fixture-57373 ps -a --format \"{{json .}}\"",
        "expected": "Parse exactly one synthetic API fixture container.",
        "observed": "Exit 0. JSON output contained ID=aaaaaaaaaaaa, Image=synthetic:1, Names=ionbin-fixture and State=exited. The loopback server recorded the container-list request; this was a stub, not a running container.",
        "outcome": "pass"
      },
      {
        "id": "docker-cli-tls-missing-rerun",
        "name": "TLS without a trust file",
        "method": "<evaluation>\\downloads\\cli\\docker\\docker\\docker.exe --host tcp://127.0.0.1:57373 --tlsverify ps",
        "expected": "Fail to initialize TLS when the isolated ca.pem file is absent.",
        "observed": "Exit 1. Failed to initialize because the isolated Docker ca.pem file did not exist.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "The context chooses the authority being contacted",
        "basis": "observed",
        "severity": "informational",
        "detail": "A context supplied by the fixture directed the client to our loopback server, whose synthetic container list was displayed. This is expected client behavior and says nothing about a real daemon.",
        "practicalAdvice": "Inspect docker context show/inspect and the target host before operations; use authenticated protected transports for remote daemons."
      },
      {
        "title": "Daemon access can carry host-level power",
        "basis": "documented",
        "severity": "high",
        "detail": "Docker documents that daemon control and host-directory mounts can grant powerful access to the host. The CLI fixture did not exercise these capabilities.",
        "practicalAdvice": "Restrict who can access the daemon, avoid broad host mounts and assess rootless mode where appropriate."
      }
    ],
    "caveats": [
      "The initial loopback attempt was denied by the host sandbox. The retained rerun used scoped execution permission and succeeded.",
      "TLS failure here is only a missing-file preflight result; no certificate chain or hostile endpoint test was run."
    ],
    "notTested": [
      "Container build/run, image pulling/scanning, daemon authorization and kernel isolation.",
      "Linux versus Windows container behavior, privileged mounts, TLS certificate validation and multi-tenant controls."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://docs.docker.com/reference/cli/docker/"
      },
      {
        "label": "Docker Engine security",
        "url": "https://docs.docker.com/engine/security/"
      }
    ],
    "reportUrl": "/interface-evaluations/docker-cli.json"
  }
}