2.1 Restrict network traffic between containers

800-53|SC-7(21)

800-53|AU-3

2.3 Allow Docker to make changes to iptables

800-53|SC-7(12)

800-53|SI-7(6)

800-53|CM-7b.

2.6 Configure TLS authentication for Docker daemon  --tlskey

800-53|SC-13

2.6 Configure TLS authentication for Docker daemon --tlscacert

2.6 Configure TLS authentication for Docker daemon --tlscert

2.6 Configure TLS authentication for Docker daemon --tlsverify

800-53|SC-6

2.13 Disable operations on legacy registry (v1)

2.15 Do not enable swarm mode, if not needed

2.16 Control the number of manager nodes in a swarm

2.17 Bind swarm services to a specific host interface

800-53|SC-7(13)

2.19 Encrypt data exchanged between containers on different nodes on the overlay network

800-53|SC-8

2.20 Apply a daemon-wide custom seccomp profile, if needed

800-53|SC-39

2.21 Avoid experimental features in production

800-53|SC-43b.

2.24 Rotate swarm manager auto-lock key periodically

3.1 Verify that docker.service file ownership is set to root:root

800-53|CM-6b.

3.2 Verify that docker.service file permissions are set to 644 or more restrictive

3.3 Verify that docker.socket file ownership is set to root:root

3.4 Verify that docker.socket file permissions are set to 644 or more restrictive

3.5 Verify that /etc/docker directory ownership is set to root:root

3.6 Verify that /etc/docker directory permissions are set to 755 or more restrictive

3.7 Verify that registry certificate file ownership is set to root:root

3.8 Verify that registry certificate file permissions are set to 444 or more restrictive

3.9 Verify that TLS CA certificate file ownership is set to root:root

3.10 Verify that TLS CA certificate file permissions are set to 444 or more restrictive

3.11 Verify that Docker server certificate file ownership is set to root:root

3.12 Verify that Docker server certificate file permissions are set to 444 or more restrictive

3.13 Verify that Docker server certificate key file ownership is set to root:root

3.14 Verify that Docker server certificate key file permissions are set to 400

3.15 Verify that Docker socket file ownership is set to root:docker

3.16 Verify that Docker socket file permissions are set to 660 or more restrictive

3.17 Verify that daemon.json file ownership is set to root:root

3.18 Verify that daemon.json file permissions are set to 644 or more restrictive

3.19 Verify that /etc/default/docker file ownership is set to root:root

3.20 Verify that /etc/default/docker file permissions are set to 644 or more restrictive

800-53|AC-6

4.2 Use trusted base images for containers

800-53|CM-7(5)

4.3 Do not install unnecessary packages in the container

800-53|CM-7

4.4 Scan and rebuild the images to include security patches

4.6 Add HEALTHCHECK instruction to the container image

4.7 Do not use update instructions alone in the Dockerfile

4.9 Use COPY instead of ADD in Dockerfile

800-53|AC-3(3)

5.3 Restrict Linux Kernel Capabilities within containers

800-53|AC-6(4)

5.5 Do not mount sensitive host system directories on containers

5.7 Do not map privileged ports within containers

5.9 Do not share the host's network namespace

5.11 Set container CPU priority appropriately

5.12 Mount container's root filesystem as read only

5.13 Bind incoming container traffic to a specific host interface

5.14 Set the 'on-failure' container restart policy to 5 - 'MaximumRetryCount'

800-53|SC-5

5.14 Set the 'on-failure' container restart policy to 5 - RestartPolicyName

5.15 Do not share the host's process namespace

5.16 Do not share the host's IPC namespace

5.17 Do not directly expose host devices to containers

800-53|SC-4

5.18 Override default ulimit at runtime only if needed

5.19 Do not set mount propagation mode to shared

5.20 Do not share the host's UTS namespace

5.21 Do not disable default seccomp profile

5.25 Restrict container from acquiring additional privileges

5.27 Ensure docker commands always get the latest version of the image

5.30 Do not share the host's user namespaces

800-53|SC-7a.

5.31 Do not mount the Docker socket inside any containers

6.1 Perform regular security audits of your host system and containers

6.2 Monitor Docker containers usage, performance and metering

CIS_Docker_1.13.0_L1_v1.0.0.audit Level 1

Revision 1.10

Jun 17, 2021

Miscellaneous