Uploaded image for project: 'Release Requirements'
  1. Release Requirements
  2. REQ-215

Containers configured per secure recommendation

XMLWordPrintable

    • Containers configured per secure recommendation
    • 3

      The Integration team must implement the following configurations specified in CIS Docker Benchmark v1.2.0 in the Docker environment.

      • Recommendations 1.2.1 – 1.2.12 in Section 1.2 Linux Hosts Specific Configuration in the Docker environment.
      • Recommendations 2.1 – 2.17 in Section 2 Docker daemon configuration in the Docker environment.
      • Recommendations 3.1 – 3.22 In Section 3 Docker daemon configuration files in the Docker environment.

      Each project team must configure the build and run time Docker images in compliance with the following CIS Docker Benchmark v1.2.0 recommendations.

      • Recommendations 4.1 – 4.4, 4.6, 4.7, 4.9 – 4.10 in Section 4 Container Images and Build File Configuration (all Level 1 requirements)
      • Recommendations 5.1, 5.3 – 5.17 in Section 5 Container Runtime Configuration (about half of the Level 1 requirements)

      It is recommended that each project team implement all of the Level 1 recommendations in Section 5 of the CIS Docker Benchmark v1.2.0.

      Notes: The project has to make sure that the containers they build will run in an environment that implements the controls specified in sections 4 and 5.

      5.1: Ensure that, if applicable, an AppArmor Profile is enabled

      • Test that your container runs properly on a host that has AppArmor installed with the default Container profile enabled

      5.3: Ensure that Linux kernel capabilities are restricted within containers

      • Ideally, your containers should run with the default Docker restrictions in place. If your container needs additional linux kernel capabilities, these must be documented in the release notes

      5.17: Ensure that host devices are not directly exposed to containers

      • Specifically containers must be started with the ability to create a device file (mknod) disabled

      CSI Docker Benchmark v.1.2.0 attached for implementation and testing instructions.

        1. CIS_Docker_Benchmark_v1.2.0.pdf
          1.89 MB
          Amy Zwarico

            zwarico Amy Zwarico
            Pawel_P Paweł Pawlak
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated: