Docker
TMA-DOCKER-5.1
Ensure swarm mode is not Enabled, if not needed
MediumLevel 1Automateddocker
Description
Swarm mode opens management ports and a raft store; it should be disabled when the host is not part of a swarm. The audit reads Swarm.LocalNodeState from docker info.
How it is checked
Audit method: Shell command
shell
docker info --format '{{.Swarm.LocalNodeState}}'- Expected output
inactive
How it is fixed
Fix method: Guidance or infrastructure patch
If swarm mode is not needed, leave it with 'docker swarm leave' (managers: --force) after migrating services.
Properties
- Operating systems
- Any
- Tags
- dockerruntimeswarm
- Reference
- CIS Docker Benchmark v1.9.0 - 5.1 Ensure swarm mode is not Enabled, if not needed
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker