Ensure network traffic is restricted between containers on the default bridge

MediumLevel 1Automateddocker

Description

By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).

How it is checked

Audit method: Shell command

shell

docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'

Expected output: false

How it is fixed

Fix method: Guidance or infrastructure patch

Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.

Properties

Operating systems: Any
Tags: dockerdaemonnetwork
Reference: CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker