Detections
Analytics

DKER-EE-004130 - Docker Enterprise older Universal Control Plane (UCP) and Docker Trusted Registry (DTR) images must be removed from all cluster nodes upon upgrading.

Information

When upgrading either the UCP or DTR components of Docker Enterprise, the newer images are pulled (or unpacked if offline) onto Engine nodes in a cluster. Once the upgrade is complete, one must manually remove all old image version from the cluster nodes to meet the requirements of this control.

When upgrading the Docker Engine - Enterprise component of Docker Enterprise, the old package version is automatically replaced.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Remove all outdated UCP and DTR container images from all nodes in the cluster:

via CLI: As a Docker EE admin, execute the following commands using a client bundle:

docker rmi -f $(docker images --filter reference='docker/ucp*:[outdated_tags]' -q)
docker rmi -f $(docker images --filter reference='docker/dtr*:[outdated_tags]' -q)

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-2(6), CAT|II, CCI|CCI-002617, Rule-ID|SV-235845r961677_rule, STIG-ID|DKER-EE-004130, STIG-Legacy|SV-104863, STIG-Legacy|V-95725, Vuln-ID|V-235845

Plugin: Unix

Control ID: c568b8aaf621857f1f49f453ec80d22151ecb154363510da3f92b902cfddc966