| 1.1.12 Ensure auditing is configured for Docker files and directories - /etc/containerd/config.toml | CIS Docker v1.8.0 L2 OS Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.2.2 Ensure that the version of Docker is up to date | CIS Docker v1.8.0 L1 OS Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.6 Setup a local registry mirror | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.9 Ensure the default cgroup usage has been confirmed | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.10 Ensure base device size is not changed until needed | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | |
| 2.12 Ensure centralized and remote logging is configured | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | AUDIT AND ACCOUNTABILITY |
| 2.14 Ensure centralized and remote logging is configured | CIS Docker v1.8.0 L2 OS Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.16 Ensure daemon-wide custom seccomp profile is applied, if needed | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.17 Ensure experimental features are avoided in production | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4 Verify that docker.socket file permissions are set to 644 or more restrictive | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.4 Verify that docker.socket file permissions are set to 644 or more restrictive | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.5 Ensure that /etc/docker directory ownership is set to root:root | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | |
| 3.5 Ensure that the /etc/docker directory ownership is set to root:root | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL |
| 3.5 Verify that /etc/docker directory ownership is set to root:root | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | |
| 3.5 Verify that /etc/docker directory ownership is set to root:root | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | |
| 3.5 Verify that /etc/docker directory ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 3.6 Ensure that /etc/docker directory permissions are set to 755 or more restrictively | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.6 Verify that /etc/docker directory permissions are set to 755 or more restrictive | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | |
| 3.6 Verify that /etc/docker directory permissions are set to 755 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 3.9 Verify that docker-network environment file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.13 Ensure that the Docker server certificate key file ownership is set to root:root | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL |
| 3.15 Verify that /etc/docker directory ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 3.16 Verify that /etc/docker directory permissions are set to 755 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 3.19 Verify that /etc/default/docker file ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.19 Verify that /etc/default/docker file ownership is set to root:root | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.5 Ensure Content trust for Docker is Enabled | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.6 Add HEALTHCHECK instruction to the container image | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.6 Ensure HEALTHCHECK instructions have been added to the container image | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.8 Ensure setuid and setgid permissions are removed in the images | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | |
| 4.11 Ensure verified packages are only Installed | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.10 Ensure that the host's network namespace is not shared | CIS Docker v1.8.0 L1 OS Linux | Unix | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.12 Ensure the container's root filesystem is mounted as read only | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.13 Ensure that the container's root filesystem is mounted as read only | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.21 Do not disable default seccomp profile | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.24 Ensure that docker exec commands are not used with the user=root option | CIS Docker v1.8.0 L2 OS Linux | Unix | ACCESS CONTROL |
| 5.27 Ensure docker commands always get the latest version of the image | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 5.27 Ensure docker commands always get the latest version of the image | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | |
| 5.28 Ensure that Docker commands always make use of the latest version of their image | CIS Docker v1.8.0 L1 OS Linux | Unix | CONFIGURATION MANAGEMENT |
| 5.29 Ensure Docker's default bridge docker0 is not used | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | CONFIGURATION MANAGEMENT |
| 6.5 Use a centralized and remote log collection service | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | AUDIT AND ACCOUNTABILITY |
| 7.5 Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | CONFIGURATION MANAGEMENT |
| 7.5 Ensure that swarm manager is run in auto-lock mode | CIS Docker v1.8.0 L1 Docker Swarm | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.8 Ensure node certificates are rotated as appropriate | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.9 Ensure CA certificates are rotated as appropriate | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | IDENTIFICATION AND AUTHENTICATION |
| 7.10 Ensure management plane traffic has been separated from data plane traffic | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured. | DISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| DKER-EE-005210 - Docker Enterprise /etc/docker directory ownership must be set to root:root - CentOS/RHEL | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-005220 - Docker Enterprise /etc/docker directory permissions must be set to 755 or more restrictive - CentOS/RHEL | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-005220 - Docker Enterprise /etc/docker directory permissions must be set to 755 or more restrictive - Ubuntu | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-006190 - Docker Enterprise Universal Control Plane (UCP) must be integrated with a trusted certificate authority (CA). | DISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
