Ensure mount propagation mode is not set to shared

MediumLevel 1Automateddocker

Description

A shared (or rshared) mount propagates mount changes between the container and the host. Flags containers with any mount whose Propagation is shared or rshared. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.

How it is checked

Audit method: Shell command

shell

ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}}{{range .Mounts}} {{.Propagation}}{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '/ r?shared( |$)/ {print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Redeploy without :shared/:rshared bind-mount propagation (use the default rprivate, or slave if required).

Properties

Operating systems: Any
Tags: dockerruntime
Reference: CIS Docker Benchmark v1.9.0 - 5.20 Ensure mount propagation mode is not set to shared

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker