Configure centralized and remote logging
Details https://docs.docker.com/engine/admin/logging/overview/ Solution Step 1- Setup the desired log driver by following its documentation.Step 2- Start the docker daemon with...
- Home
- Security Hardening
- CIS Docker 1.12.0 V1.0.0 L2 Docker
CIS Docker 1.12.0 V1.0.0 L2 Docker
Confirm default cgroup usage
Details https://docs.docker.com/engine/reference/commandline/daemon/ Solution The default setting is good enough and can be left as-is. If you want to specifically set...Do not change base device size until needed
Details https://docs.docker.com/engine/reference/commandline/daemon/#storage-driver-options NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance. Solution Do not...Do not disable AppArmor
Details AppArmor is an effective and easy-to-use Linux application security system. It is available on quite a few Linux distributions...Do not docker exec commands with privileged option
Details https://docs.docker.com/engine/reference/commandline/exec/ NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance. Solution Do not...Do not docker exec commands with user option
Details https://docs.docker.com/engine/reference/commandline/exec/ NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance. Solution Do not...Do not use Docker’s default bridge docker0
Details Do not use Docker’s default bridge docker0. Use docker’s user-defined networks for container networking.Docker connects virtual interfaces created in...Enable Content trust for Docker
Details https://docs.docker.com/engine/security/trust/content_trust/ 2.https://docs.docker.com/engine/reference/commandline/cli/#notary 3.https://docs.docker.com/engine/reference/commandline/cli/#environment-variables Solution To enable content trust in a bash shell, enter the following command-export DOCKER_CONTENT_TRUST=1Alternatively, set this...Enable user namespace support
Details Enable user namespace support in Docker daemon to utilize container user to host user re- mapping. This recommendation is...Install verified packages only
Details Verify authenticity of the packages before installing them in the image.Verifying authenticity of the packages is essential for building...