# Ensure that the 'on-failure' container restart policy is set to '5'

- Source: https://support.icompaas.com/support/solutions/articles/62000234396-ensure-that-the-on-failure-container-restart-policy-is-set-to-5-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**  
    

**Description:**

The Docker \--restart policy controls the restart behavior of containers in case of failure. Setting it to on-failure:5 ensures that the container restarts only up to five times after a failure, helping to avoid an infinite restart loop while ensuring the container gets restarted after temporary issues.

**Rationale:**

Limiting the number of retries helps to ensure that containers are not restarted indefinitely in case of persistent failures, preventing unnecessary resource usage and potential system instability.  

**Impact:**

**Pros:**  

-   Reduces the likelihood of containers being stuck in a restart loop.  
    
-   Helps in managing resource utilization by limiting restarts.  
    

Cons:  

-   Containers that are failing beyond the limit will not be restarted, potentially leaving them in a non-operational state.  
    

**Default Value:**

-   By default, Docker does not set a restart policy, which means containers will not restart automatically on failure unless configured.  
    

**Pre-requisites:**

-   Docker should be installed and running on the host.  
    
-   Administrative privileges to configure Docker container parameters.  
    

**Remediation:**

**Test Plan:**

**Using AWS Console:**

1.  Navigate to the EC2 instance running Docker.  
    
2.  Open the terminal and check the restart policy for existing containers using the docker inspect command.

docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' container\_name

**Using AWS CLI:**

1.  Connect to the EC2 instance where Docker is running.  
    
2.  Run the following command to verify the restart policy for containers:  
    

docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' container\_name

  

**Implementation Plan:**

**Using AWS Console:**

-   Log in to the EC2 instance.  
    
-   When running or creating a container, specify the \--restart on-failure:5 option:
    
    docker run --restart on-failure:5 <image\_name>
    
      
    

**Using AWS CLI:**

1.  Use SSM to remotely start a container with the \--restart on-failure:5 policy.

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["docker run --restart on-failure:5 <image\_name>"\]'

  

**Backout Plan:**

**Using AWS Console:**

-   Connect to the EC2 instance.  
    
-   Stop and remove the container.  
    
    docker stop container\_name
    docker rm container\_name
    
      
    

**Using AWS CLI:**

1.  Use SSM to stop and remove the container remotely.  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["docker stop container\_name && docker rm container\_name"\]'

  

**References:**

1.  CIS Docker Benchmark v1.7  
    
2.  Docker Documentation: [https://docs.docker.com/](https://docs.docker.com/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.