# Ensure that the Memory Usage for Containers is Limited

- Source: https://support.icompaas.com/support/solutions/articles/62000234408-ensure-that-the-memory-usage-for-containers-is-limited
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   Level 1  
    

Description:

Limiting memory usage for containers ensures that containers do not consume excessive resources, preventing one container from affecting the performance of others or the host system. This can be done by specifying memory limits during container runtime.  

Rationale:

Unrestricted memory usage can cause containers to consume all available system memory, leading to potential crashes or slowdowns for other processes and services. Setting memory limits prevents this by ensuring that containers use only the resources they are allocated.  

Impact:

Pros:  

-   Prevents containers from over-consuming system resources.  
    
-   Enhances the overall stability and reliability of the host system and other containers.  
    

Cons:  

-   May require tuning of memory limits to ensure applications perform optimally.  
    

Default Value:

By default, Docker containers are not limited in terms of memory and can use as much system memory as available.  

Pre-requisites:

-   Docker must be installed on the host system.  
    
-   Knowledge of the container's resource requirements to configure appropriate memory limits.  
    

Remediation:

Test Plan:

Using AWS Console:

1.  Navigate to the EC2 instance running Docker.  
    
2.  Inspect container configurations for memory limits by checking the docker run command or Docker Compose configurations for any specified \--memory flags.

Using AWS CLI:

1.  Connect to the EC2 instance.  
    
2.  Run the following command to check the memory configuration for running containers:
    
    docker stats --no-stream
    

Implementation Plan:

Using AWS Console:

1.  Log in to the EC2 instance  
    
2.  Specify memory limits when running a container:
    
    docker run --memory="512m" --name container\_name image\_name
    

Optionally, modify Docker Compose files to include the memory limit under the services section:

services:
  service\_name:
    image: image\_name
    deploy:
      resources:
        limits:
          memory: 512M

Using AWS CLI:

1.  Use SSM to remotely deploy the memory limit configuration on the EC2 instance.  
    
2.  Run the following command to set a memory limit:
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["docker run --memory=\\"512m\\" --name container\_name image\_name"\]'
    

Backout Plan:

Using AWS Console:

1.  Connect to the EC2 instance.  
    
2.  Remove or adjust memory limits from the Docker run command or Docker Compose file.  
    
3.  Restart the container with the new configuration.  
    

Using AWS CLI:

1.  Use SSM to remove or adjust the memory limit.  
    
2.  Run the following command to update the container:
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["docker update --memory=\\"1g\\" container\_name"\]'
    
      
    

References:

-   Docker Memory Limit Documentation  
    
-   CIS Docker Benchmark v1.7

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.