Detections
Analytics
DKER-EE-002130 - The Docker Enterprise socket must not be mounted inside any containers.
Information
The docker socket docker.sock (Linux) and \.pipedocker_engine (Windows) should not be mounted inside a container, with the exception case being during the installation of Universal Control Plane (UCP) component of Docker Enterprise as it is required for install.If the docker socket is mounted inside a container it would allow processes running within the container to execute docker commands which effectively allows for full control of the host.
By default, docker.sock (linux) and \.pipedocker_engine (windows) is not mounted inside containers.
Solution
When using the -v/--volume flags to mount volumes to containers in a docker run command, do not use docker.sock as a volume.A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.
See Also
Item Details
Audit Name: DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7a., CAT|I, CCI|CCI-000381, Rule-ID|SV-235818r960963_rule, STIG-ID|DKER-EE-002130, STIG-Legacy|SV-104809, STIG-Legacy|V-95671, Vuln-ID|V-235818
Plugin: Unix
Control ID: fee05d410d998879dc39f3a472f7c0208c582ef19a148cafb77f9e1e15597554