Ensure the default ulimit is configured appropriately

보통레벨 1수동 검토docker

설명

Set the default ulimit options as appropriate in your environment. ulimit provides control over the resources available to the shell and to processes which it starts. Setting system resource limits judiciously can save you from disasters such as a fork bomb. Reported as a manual review item: the audit needs a site-specific judgement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

To confirm this setting you should review the dockerd start-up options and any settings in /etc/docker/daemon.json. To review the dockerd startup options, use: ps -ef | grep dockerd Ensure that the --default-ulimit parameter is set as appropriate. The contents of /etc/docker/daemon.json should also be reviewed for this setting.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run Docker in daemon mode and pass --default-ulimit as argument with respective ulimits as appropriate in your environment and in line with your security policy. For example: dockerd --default-ulimit nproc=1024:2048 --default-ulimit nofile=100:200

속성

운영 체제: 모두
태그: dockermanual
참고 자료: CIS Docker Benchmark v1.9.0 - 2.9 Ensure the default ulimit is configured appropriately