Ensure that HEALTHCHECK instructions have been added to container images

NiedrigStufe 1Automatisiertdocker

Beschreibung

A HEALTHCHECK lets the engine detect and report unhealthy containers. Flags running containers whose configuration (inherited from the image) has no healthcheck. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}}{{if .Config.Healthcheck}} yes{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk 'NF<2 {print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Add a HEALTHCHECK instruction to the Dockerfile (or --health-cmd at run time) and rebuild the image.

Eigenschaften

Betriebssysteme: Beliebig
Tags: dockerimageruntime
Referenz: CIS Docker Benchmark v1.9.0 - 4.5 Ensure that HEALTHCHECK instructions have been added to container images

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target docker