TMA-DOCKER-2.2
Ensure network traffic is restricted between containers on the default bridge
MediaNivel 1Automatizadadocker
Descripción
By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).
Cómo se verifica
Método de auditoría: Comando de shell
shell
docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'- Salida esperada
false
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- dockerdaemonnetwork
- Referencia
- CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target docker