Cis Docker 4.3
DevOps & Securitycis-docker-4.3Cis Docker 4.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that unnecessary packages are not installed in the container
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-4.3/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-4-3, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
4.3 Ensure that unnecessary packages are not installed in the container (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
Containers should have as small a footprint as possible, and should not contain unnecessary software packages which could increase their attack surface.
Rationale
Unnecessary software should not be installed into containers, as doing so increases their attack surface. Only packages strictly necessary for the correct operation of the application being deployed should be installed.
Impact
None.
Audit Procedure
List all the running instances of containers by executing the command below:
docker ps --quiet
For each container instance, execute the relevant command for listing all installed packages, e.g.:
docker exec $INSTANCE_ID rpm -qa
The command above lists the packages installed. You should review the list and ensure that everything installed is actually required.
Remediation
You should not install anything within the container that is not required.
You should consider using a minimal base image rather than the standard Centos, Debian, or Red Hat images if you can. Some of the options available include BusyBox and Alpine.
Not only can this trim your image size considerably, but there would also be fewer pieces of software which could contain vectors for attack.
Default Value
Not Applicable.
References
- https://docs.docker.com/develop/develop-images/baseimages/
- https://jpetazzo.github.io/2020/02/01/quest-minimal-docker-images-part-1/
CIS Controls
v8
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.
v7
5.2 Maintain Secure Images
Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.