Docker
TMA-DOCKER-5.17
Ensure that the host's IPC namespace is not shared
HighLevel 1Automateddocker
Description
Sharing the host's IPC namespace exposes host shared memory segments and semaphores to the container. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.
How it is checked
Audit method: Shell command
shell
ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}} {{.HostConfig.IpcMode}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '$2=="host"{print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Redeploy without --ipc=host (compose: remove 'ipc: host').
Properties
- Operating systems
- Any
- Tags
- dockerruntime
- Reference
- CIS Docker Benchmark v1.9.0 - 5.17 Ensure that the host's IPC namespace is not shared
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker