Docker
TMA-DOCKER-5.27
Ensure that container health is checked at runtime
LowLevel 1Automateddocker
Description
The container health status must be checked at runtime. Flags running containers that report no health status (no healthcheck configured). The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.
How it is checked
Audit method: Shell command
shell
ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}}{{if .State.Health}} {{.State.Health.Status}}{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk 'NF<2 {print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Configure a healthcheck (HEALTHCHECK in the image or --health-cmd at run time) and monitor docker inspect .State.Health.Status.
Properties
- Operating systems
- Any
- Tags
- dockerruntime
- Reference
- CIS Docker Benchmark v1.9.0 - 5.27 Ensure that container health is checked at runtime
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker