Ensure that only needed ports are open on the container

Trung bìnhCấp 1Xem xét thủ côngdocker

Mô tả

The Dockerfile for a container image defines the ports which are opened by default on a container instance. The list of ports are relevant to the application you are running within the container and should only be open if they are needed. A container can be run with only the ports defined in the Dockerfile for its image or can alternatively be arbitrarily passed run time parameters to open a list of ports. Reported as a manual review item: the audit needs a site-specific judgement.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

You should list all the running instances of containers and their associated port mappings by executing the command below: docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}' You should then review the list and ensure that all the ports mapped are in fact genuinely required by each container.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

You should ensure that the Dockerfile for each container image only exposes needed ports. You can also completely ignore the list of ports defined in the Dockerfile by NOT using -P (UPPERCASE) or the --publish-all flag when starting the container. Instead, use the -p (lowercase) or --publish flag to explicitly define the ports that you need for a particular container instance. For example: docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: dockermanual
Tham chiếu: CIS Docker Benchmark v1.9.0 - 5.9 Ensure that only needed ports are open on the container