Cis Docker 2.5
DevOps & Securitycis-docker-2.5Cis Docker 2.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure insecure registries are not used
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-2.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-2-5, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure insecure registries are not used (Manual)
Profile Applicability
• Level 1 - Docker - Linux
Description
Docker considers a private registry either secure or insecure. By default, registries are considered secure.
Rationale
A secure registry uses TLS. A copy of registry's CA certificate is placed on the Docker host at /etc/docker/certs.d/<registry-name>/ directory. An insecure registry is one which does not have a valid registry certificate, or one not using TLS. Insecure registries should not be used as they present a risk of traffic interception and modification.
Additionally, once a registry has been marked as insecure commands such as docker pull, docker push, and docker search will not result in an error message and users may indefinitely be working with this type of insecure registry without ever being notified of the risk of potential compromise.
Impact
None.
Audit Procedure
You should execute the command below to find out if any insecure registries are in use:
docker info --format 'Insecure Registries:'
Remediation
You should ensure that no insecure registries are in use.
Default Value
By default, Docker assumes all, but local, registries are secure.
Additional Information
Docker engine always include 127.0.0.0/8 and ::1/128 as insecure registers
References
None listed in the benchmark.
CIS Controls
Controls Version: v8
Control: 2.5 Allowlist Authorized Software
Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
IG 1: IG 2: ● IG 3: ●
Controls Version: v7
Control: 14.4 Encrypt All Sensitive Information in Transit
Encrypt all sensitive information in transit.
IG 1: IG 2: ● IG 3: ●