Docker
TMA-DOCKER-2.5
Ensure insecure registries are not used
HighLevel 1Automateddocker
Description
Insecure registries are contacted without TLS verification, exposing image pulls to tampering. The audit lists the registry index configs that docker info reports as not secure (the default loopback CIDRs are not listed) and expects none.
How it is checked
Audit method: Shell command
shell
out=$(docker info --format '{{range .RegistryConfig.IndexConfigs}}{{if not .Secure}}{{.Name}}{{"\n"}}{{end}}{{end}}') || exit 1; n=$(printf '%s\n' "$out" | grep -c . || true); echo "$n"- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Remove entries from "insecure-registries" in /etc/docker/daemon.json (and --insecure-registry start-up flags), configure TLS on the registries, and restart the Docker daemon.
Properties
- Operating systems
- Any
- Tags
- dockerdaemonregistry
- Reference
- CIS Docker Benchmark v1.9.0 - 2.5 Ensure insecure registries are not used
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker