Ensure network traffic is restricted between containers on the default bridge

SedangLevel 1Otomatisdocker

Deskripsi

By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).

Cara pemeriksaan

Metode audit: Perintah shell

shell

docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'

Output yang diharapkan: false

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.

Properti

Sistem operasi: Apa saja
Tag: dockerdaemonnetwork
Referensi: CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target docker