CIS Docker Benchmark
116 articles
- Ensure a Separate Partition for Containers Has Been Created
- Ensure Only Trusted Users Are Allowed to Control Docker Daemon
- Ensure Auditing is Configured for the Docker Daemon
- Ensure Auditing is Configured for Docker Files and Directories - /run/containerd
- Ensure Auditing is Configured for Docker Files and Directories - /var/lib/docker
- Ensure Auditing is Configured for Docker Files and Directories - /etc/docker
- Ensure Auditing is Configured for Docker Files and Directories - docker.service
- Ensure Auditing is Configured for Docker Files and Directories - containerd.sock
- Ensure Auditing is Configured for Docker Files and Directories - docker.sock
- Ensure Auditing is Configured for Docker Files and Directories - /etc/default/docker
- Ensure Auditing is Configured for Docker Files and Directories - /etc/docker/daemon.json
- Ensure Auditing is Configured for Docker Files and Directories - /etc/containerd/config.toml
- Ensure Auditing is Configured for Docker Files and Directories - /etc/sysconfig/docker
- Ensure auditing is configured for Docker files and directories - /usr/bin/containerd
- Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim
- Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v1
- Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim-runc-v2
- Ensure auditing is configured for Docker files and directories - /usr/bin/runc
- Ensure the container host has been Hardened
- Ensure that the version of Docker is up to date
- Run the Docker daemon as a non-root user, if possible
- Ensure network traffic is restricted between containers on the default bridge
- Ensure the logging level is set to 'info'
- Ensure Docker is allowed to make changes to iptables
- Ensure insecure registries are not used
- Ensure TLS authentication for Docker daemon is configured
- Ensure TLS authentication for Docker daemon is configured
- Ensure the default ulimit is configured appropriately
- Enable user namespace support
- Ensure the default cgroup usage has been confirmed
- Ensure base device size is not changed until needed
- Ensure that authorization for Docker client commands is enabled
- Ensure centralized and remote logging is configured
- Ensure containers are restricted from acquiring new privileges
- Ensure live restore is enabled
- Ensure Userland Proxy is Disabled
- Ensure that a daemon-wide custom seccomp profile is applied if appropriate
- Ensure that experimental features are not implemented in production
- Ensure that the docker.service file ownership is set to root:root
- Ensure that docker.service file permissions are appropriately set
- Ensure that docker.socket file ownership is set to root:root
- Ensure that docker.socket file permissions are set to 644 or more restrictive
- Ensure that the /etc/docker directory ownership is set to root:root
- Ensure that /etc/docker directory permissions are set to 755 or more restrictively
- Ensure that registry certificate file ownership is set to root:root
- Ensure that registry certificate file permissions are set to 444 or more restrictively
- Ensure that TLS CA certificate file ownership is set to root:root to root.
- Ensure that TLS CA certificate file permissions are set to 444 or more restrictively
- Ensure that Docker server certificate file ownership is set to root:root
- Ensure that the Docker server certificate file permissions are set to 444 or more restrictively
- Ensure that the Docker server certificate key file ownership is set to root:root
- Ensure that the Docker server certificate key file permissions are set to 400
- Ensure that management plane traffic is separated from data plane traffic
- Ensure that the Docker socket file ownership is set to root:docker
- Ensure that the Docker socket file permissions are set to 660 or more restrictively
- Ensure that the daemon.json file ownership is set to root:root
- Ensure that the /etc/default/docker file ownership is set to root:root
- Ensure that CA certificates are rotated as appropriate
- Ensure that cgroup usage is confirmed
- Ensure that the Container is Restricted from Acquiring Additional Privileges
- Ensure that Container Health is Checked at Runtime
- Ensure that the /etc/default/docker file permissions are set to 644 or more restrictively
- Ensure that the /etc/sysconfig/docker file permissions are set to 644 or more restrictively
- Ensure that Docker commands always make use of the latest version of their image
- Ensure that the /etc/sysconfig/docker file ownership is set to root:root
- Ensure that the PIDs cgroup limit is used
- Ensure that the Containerd socket file ownership is set to root:root
- Ensure that Docker's default bridge "docker0" is not used
- Ensure that the Host's User Namespaces are Not Shared
- Ensure that the Containerd socket file permissions are set to 660 or more restrictively
- Ensure that Node Certificates are Rotated as Appropriate
- Ensure that a user for the container has been created
- Ensure that the Docker socket is not mounted inside any containers
- Ensure that Image Sprawl is Avoided
- Ensure that containers use only trusted base images
- Ensure that Container Sprawl is Avoided
- Ensure that unnecessary packages are not installed in the container
- Ensure images are scanned and rebuilt to include security patches
- Ensure Content Trust for Docker is Enabled
- Ensure that HEALTHCHECK instructions have been added to container images
- Ensure update instructions are not used alone in Dockerfiles
- Ensure that the minimum number of manager nodes have been created in a swarm
- Ensure that Swarm Services Are Bound to a Specific Host Interface
- Ensure that the Swarm Manager Auto-Lock Key is Rotated Periodically
- Ensure that Swarm Manager is Run in Auto-Lock Mode
- Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster
- Ensure that all Docker swarm overlay networks are encrypted
- Ensure that docker exec commands are not used with the user=root option
- Ensure that Docker exec commands are not used with the privileged option
- Ensure the Default Seccomp Profile is Not Disabled
- Ensure setuid and setgid permissions are removed
- Ensure that COPY is used instead of ADD in Dockerfiles
- Ensure secrets are not stored in Dockerfiles
- Ensure only verified packages are installed
- Ensure all signed artifacts are validated
- Ensure swarm mode is not enabled, if not needed
- Ensure that, if applicable, SELinux security options are set
- Ensure that CPU priority is set appropriately on containers
- Ensure that Linux kernel capabilities are restricted within containers
- Ensure that the container's root filesystem is mounted as read-only
- Ensure that Incoming Container Traffic is Bound to a Specific Host Interface
- Ensure that privileged containers are not used
- Ensure that the 'on-failure' container restart policy is set to '5'
- Ensure that the Host's Process Namespace is Not Shared
- Ensure that the host's process namespace is not shared
- Ensure sensitive host system directories are not mounted on containers
- Ensure that Host Devices Are Not Directly Exposed to Containers
- Ensure sshd is not run within containers
- Ensure that the Default ulimit is Overwritten at Runtime if Needed
- Ensure privileged ports are not mapped within containers
- Ensure Mount Propagation Mode is Not Set to Shared
- Ensure that the Host's UTS Namespace is Not Shared
- Ensure that only needed ports are open on the container
- Ensure that the host's network namespace is not shared
- Ensure that the Memory Usage for Containers is Limited
- Ensure that, if applicable, an AppArmor Profile is enabled