Detections
Analytics

DKER-EE-002130 - The Docker Enterprise socket must not be mounted inside any containers.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The docker socket docker.sock (Linux) and \.pipedocker_engine (Windows) should not be mounted inside a container, with the exception case being during the installation of Universal Control Plane (UCP) component of Docker Enterprise as it is required for install.

If the docker socket is mounted inside a container it would allow processes running within the container to execute docker commands which effectively allows for full control of the host.

By default, docker.sock (linux) and \.pipedocker_engine (windows) is not mounted inside containers.

Solution

When using the -v/--volume flags to mount volumes to containers in a docker run command, do not use docker.sock as a volume.

A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2), CAT|I, CCI|CCI-000381, Rule-ID|SV-104809r1_rule, STIG-ID|DKER-EE-002130, Vuln-ID|V-95671

Plugin: Unix

Control ID: 0ac76170e593ebb2b7b020f4888a7426f4cf6ca9f0b7187b6e32f045f253382e