Ensure network traffic is restricted between containers on the default bridge

SrednjaNivo 1Automatskadocker

Opis

By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).

Kako se proverava

Metod provere: Komanda ljuske

shell

docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'

Očekivani izlaz: false

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.

Svojstva

Operativni sistemi: Bilo koji
Oznake: dockerdaemonnetwork
Referenca: CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target docker