Ensure Docker is allowed to make changes to iptables

MediumLevel 1Automateddocker

Description

Docker must manage iptables so that container networking rules stay consistent with the daemon configuration. Compliant unless iptables is explicitly set to false. The audit reads the running dockerd command line (ps) together with /etc/docker/daemon.json.

How it is checked

Audit method: Shell command

shell

args=$(ps -eo args 2>/dev/null) || exit 1; s=$(printf '%s\n' "$args" | grep '[d]ockerd'; cat /etc/docker/daemon.json 2>/dev/null); printf '%s\n' "$s" | grep -Eq -e '--iptables[= ]+false|"iptables"[[:space:]]*:[[:space:]]*false' && echo noncompliant || echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Remove "iptables": false from /etc/docker/daemon.json and --iptables=false from the dockerd start-up flags, then restart the Docker daemon.

Properties

Operating systems: Any
Tags: dockerdaemonnetwork
Reference: CIS Docker Benchmark v1.9.0 - 2.4 Ensure Docker is allowed to make changes to iptables

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker