Cis Docker 2.16
DevOps & Securitycis-docker-2.16Cis Docker 2.16 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure live restore is enabled
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-2.16/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-2-16, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure live restore is enabled (Manual)
Profile Applicability
• Level 1 - Docker - Linux
Description
The --live-restore option enables full support of daemon-less containers within Docker. It ensures that Docker does not stop containers on shutdown or restore and that it properly reconnects to the container when restarted.
Rationale
One of the important security triads is availability. Setting the --live-restore flag within the Docker daemon ensures that container execution is not interrupted when it is not available. This also makes it easier to update and patch the Docker daemon without application downtime.
Impact
None.
Audit Procedure
You should run docker info and ensure that the Live Restore Enabled property is set to true.
docker info --format '{{ .LiveRestoreEnabled }}'
Alternatively, you could run the below command and ensure that --live-restore is in use.
grep "--live-restore" /etc/docker/daemon.json
The contents of /etc/docker/daemon.json should also be reviewed to ensure this setting is in place.
Remediation
Run Docker in daemon mode and pass --live-restore to it as an argument.
For Example,
dockerd --live-restore
Default Value
By default, --live-restore is not enabled.
References
CIS Controls
Controls Version: v8
Control: 16.10 Apply Secure Design Principles in Application Architectures
Apply secure design principles in application architectures. Secure design principles include the concept of least privilege and enforcing mediation to validate every operation that the user makes, ensuring that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats. Secure design also means minimizing the application infrastructure attack surface, such as turning off unprotected ports and services, removing unnecessary programs and files, and renaming or removing default accounts.
IG 1: IG 2: ● IG 3: ●
Controls Version: v7
Control: 18 Application Software Security
Application Software Security