Cis Docker 4.6
DevOps & Securitycis-docker-4.6Cis Docker 4.6 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that HEALTHCHECK instructions have been added to container images
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-4.6/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-4-6, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
4.6 Ensure that HEALTHCHECK instructions have been added to container images (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
You should add the HEALTHCHECK instruction to your Docker container images in order to ensure that health checks are executed against running containers.
Rationale
An important security control is that of availability. Adding the HEALTHCHECK instruction to your container image ensures that the Docker engine periodically checks the running container instances against that instruction to ensure that containers are still operational.
Based on the results of the health check, the Docker engine could terminate containers which are not responding correctly, and instantiate new ones.
Impact
None.
Audit Procedure
You should run the command below to ensure that Docker images have the appropriate HEALTHCHECK instruction configured.
docker inspect --format='{{ .Config.Healthcheck }}' <IMAGE>
Remediation
You should follow the Docker documentation and rebuild your container images to include the HEALTHCHECK instruction.
Default Value
By default, HEALTHCHECK is not set.
References
CIS Controls
v8
16.12 Implement Code-Level Security Checks
Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed.
v7
5.2 Maintain Secure Images
Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.