Ensure that management plane traffic is separated from data plane traffic

보통레벨 1수동 검토docker

설명

9/30/26 1.9.0 Included support for Docker V29.x 9/30/26 1.9.0 Edited grammar and typos in recommendation 1.1.13 Ticket #28427 9/30/26 1.9.0 Updated syntax in recommendation 1.1.5 Ticket #28426 9/30/26 1.9.0 Edit command usage in recommendation 7.9 Ticket #28425 9/30/26 1.9.0 Updates service name in recommendation 3.24 ... Separating management plane traffic from data plane traffic ensures that these types of traffic are segregated from each other. These traffic flows can then be individually monitored and tied to different traffic ... Reported as a manual review item: the audit needs a site-specific judgement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

You should run the command below on each swarm node and ensure that the management plane address is different from the data plane address. docker info --format 'Swarm Node Address: {{.Swarm.NodeAddr}}' Expected state: You should initialize the swarm with dedicated interfaces for management and data planes respectively. For example: docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3

조치 방법

조치 방식: 가이드 또는 인프라 패치

You should initialize the swarm with dedicated interfaces for management and data planes respectively. For example: docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3

속성

운영 체제: 모두
태그: dockermanual
참고 자료: CIS Docker Benchmark v1.9.0 - 7.9 Ensure that management plane traffic is separated from data plane traffic