You did everything right, it is the correct InSpec test and use with Docker!
You encountered a bug in InSpec that is related to InSpec's netstat output parsing combination with Alpine's netstat output.
See InSpec's output for postgres container instead of postgres:alpine:
$ inspec exec docker_test.rb -t docker://1c8162517c22 ...
What I would suggest, like comments under your post, is to take this to the #inspec channel on the Chef Community Slack to ask there. That said, here's how I might attack this:
control 'some-control-slug' do
title 'My control'
desc 'Example code for Stack Exchange'
if os.windows? && ::Gem::Version.new(os.release) < ::Gem::...
A few initial comments for posterity:
You can check exactly what the control is asserting by looking at the source code
You can see what the remediation should be, by checking Dev-Sec's Ansible role
Most of your issues seem to be related to missing or incorrect input variables. See the Inspec documentation on that topic
The specific issues you raise:
I think what you are looking for is lifecycle hooks.
For example, you could have this in you kitchen.yml file.
- name: default
- local: <script>