Ensure that the host's UTS namespace is not shared

MediumLevel 1Automateddocker

Description

Sharing the host's UTS namespace allows the container to change the host's hostname. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.

How it is checked

Audit method: Shell command

shell

ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}} {{.HostConfig.UTSMode}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '$2=="host"{print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Redeploy without --uts=host (compose: remove 'uts: host').

Properties

Operating systems: Any
Tags: dockerruntime
Reference: CIS Docker Benchmark v1.9.0 - 5.21 Ensure that the host's UTS namespace is not shared

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker