Ensure network traffic is restricted between containers on the default bridge

中级别 1自动化docker

说明

By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).

检查方式

审计方法: Shell 命令

shell

docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'

预期输出: false

修复方式

修复方法: 操作指南或基础设施补丁

Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.

属性

操作系统: 任意
标签: dockerdaemonnetwork
参考: CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target docker