Do not mount sensitive host system directories on containers
Details Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in...
- Home
- Security Hardening
- CIS Docker 1.11.0 V1.0.0 L1 Docker
CIS Docker 1.11.0 V1.0.0 L1 Docker
Do not run ssh within containers
Details http://blog.docker.com/2014/06/why-you-dont-need-to-run-sshd-in-docker/ Solution Uninstall SSH server from the container and use nsenter or any other commands such as docker exec...Do not share the host’s IPC namespace
Details https://docs.docker.com/reference/run/#ipc-settings 2.http://man7.org/linux/man-pages/man7/namespaces.7.html Solution Do not start a container with ‘–ipc=host’ argument.For example, do not start a container as below-docker...Do not share the host’s network namespace
Details http://docs.docker.com/articles/networking/#how-docker-networks-a-container 2.https://github.com/docker/docker/issues/6401 Solution Do not pass ‘–net=host’ option when starting the container.Impact-None.Default Value-By default, container connects to Docker bridge....Do not share the host’s process namespace
Details https://docs.docker.com/reference/run/#pid-settings 2.http://man7.org/linux/man-pages/man7/pid_namespaces.7.html Solution Do not start a container with ‘–pid=host’ argument.For example, do not start a container as below-docker...Do not use insecure registries
Details https://docs.docker.com/registry/insecure/ Solution Do not use any insecure registries. For example, do not start the Docker daemon as below-docker daemon...Do not use privileged containers
Details Using the–privilegedflag gives all Linux Kernel Capabilities to the container thus overwriting the –cap-add and –cap-drop flags. Ensure that...Do not use the aufs storage driver
Details Do not use ‘aufs’ as storage driver for your Docker instance.The ‘aufs’ storage driver is the oldest storage driver....Limit memory usage for container
Details By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of...Mount container’s root filesystem as read only
Details The container’s root file system should be treated as a ‘golden image’ and any writes to the root filesystem...