Home
Security Hardening
DISA STIG Docker Enterprise 2.x Linux Unix V2R1

DISA STIG Docker Enterprise 2.x Linux Unix V2R1

DKER-EE-001050 – TCP socket binding for all Docker Engine – Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.
Details The UCP component of Docker Enterprise configures and leverages Swarm Mode for node-to-node cluster communication. Swarm Mode is built...
DKER-EE-001070 – FIPS mode must be enabled on all Docker Engine – Enterprise nodes – docker info .SecurityOptions
Details When FIPS mode is enabled on a Docker Engine – Enterprise node, it uses FIPS-validated cryptography to protect the...
DKER-EE-001090 – The host operating systems auditing policies for the Docker Engine – Enterprise component of Docker Enterprise must be set – docker paths
Details The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities....
DKER-EE-001090 – The host operating systems auditing policies for the Docker Engine – Enterprise component of Docker Enterprise must be set – docker services
Details The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities....
DKER-EE-001940 – SELinux security options must be set on Red Hat or CentOS systems for Docker Enterprise.
Details SELinux provides a Mandatory Access Control (MAC) system on RHEL and CentOS that greatly augments the default Discretionary Access...
DKER-EE-001190 – Docker Enterprise sensitive host system directories must not be mounted on containers.
Details Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in...
DKER-EE-001240 – The Docker Enterprise hosts process namespace must not be shared.
Details Process ID (PID) namespaces isolate the PID number space, meaning that processes in different PID namespaces can have the...
DKER-EE-001250 – The Docker Enterprise hosts IPC namespace must not be shared.
Details IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores, and message queues. IPC namespace on the...
DKER-EE-001370 – log-opts on all Docker Engine – Enterprise nodes must be configured.
Details The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities....
DKER-EE-001590 – Docker Enterprise must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
Details The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities....

DISA STIG Docker Enterprise 2.x Linux Unix V2R1

DKER-EE-001050 – TCP socket binding for all Docker Engine – Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.

DKER-EE-001070 – FIPS mode must be enabled on all Docker Engine – Enterprise nodes – docker info .SecurityOptions

DKER-EE-001090 – The host operating systems auditing policies for the Docker Engine – Enterprise component of Docker Enterprise must be set – docker paths

DKER-EE-001090 – The host operating systems auditing policies for the Docker Engine – Enterprise component of Docker Enterprise must be set – docker services

DKER-EE-001940 – SELinux security options must be set on Red Hat or CentOS systems for Docker Enterprise.

DKER-EE-001190 – Docker Enterprise sensitive host system directories must not be mounted on containers.

DKER-EE-001240 – The Docker Enterprise hosts process namespace must not be shared.

DKER-EE-001250 – The Docker Enterprise hosts IPC namespace must not be shared.

DKER-EE-001370 – log-opts on all Docker Engine – Enterprise nodes must be configured.

DKER-EE-001590 – Docker Enterprise must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.