Docker
TMA-DOCKER-5.8
Ensure privileged ports are not mapped within containers
MediumLevel 1Automateddocker
Description
Mapping container ports to host ports below 1024 lets containers occupy ports normally reserved for privileged host services. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.
How it is checked
Audit method: Shell command
shell
ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}}{{range $p, $c := .NetworkSettings.Ports}}{{range $c}} {{.HostPort}}{{end}}{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '{for(i=2;i<=NF;i++) if($i+0>0 && $i+0<1024) print $1" "$i}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Republish the container on a host port >= 1024 (docker run -p 8080:80 ...) and remove privileged port mappings from compose files.
Properties
- Operating systems
- Any
- Tags
- dockerruntimenetwork
- Reference
- CIS Docker Benchmark v1.9.0 - 5.8 Ensure privileged ports are not mapped within containers
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker