TMA-DOCKER-2.10
Enable user namespace support
MediumLevel 2Automateddocker
Description
User namespace remapping maps root inside containers to an unprivileged host UID, limiting the impact of a container breakout. The audit checks that docker info lists name=userns under SecurityOptions.
How it is checked
Audit method: Shell command
shell
o=$(docker info --format '{{range .SecurityOptions}}{{.}} {{end}}') || exit 1; printf '%s\n' "$o" | grep -q 'name=userns' && echo compliant || echo missing- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Ensure /etc/subuid and /etc/subgid contain a mapping, set "userns-remap": "default" in /etc/docker/daemon.json and restart the Docker daemon (existing images and volumes need to be re-created).
Properties
- Operating systems
- Any
- Tags
- dockerdaemon
- Reference
- CIS Docker Benchmark v1.9.0 - 2.10 Enable user namespace support
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker --level 2