Ensure network traffic is restricted between containers on the default bridge

中等級 1自動化docker

說明

By default all containers on the default bridge can talk to each other without restriction. The audit reads the com.docker.network.bridge.enable_icc option of the default "bridge" network, which must be false (set by "icc": false).

檢查方式

稽核方法: Shell 指令

shell

docker network inspect bridge --format '{{index .Options "com.docker.network.bridge.enable_icc"}}'

預期輸出: false

修補方式

修補方法: 操作指南或基礎設施修補檔

Set "icc": false in /etc/docker/daemon.json (or start dockerd with --icc=false) and restart the Docker daemon; use user-defined networks and --link for containers that must communicate.

屬性

作業系統: 不限
標籤: dockerdaemonnetwork
參考資料: CIS Docker Benchmark v1.9.0 - 2.2 Ensure network traffic is restricted between containers on the default bridge

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target docker