# Cis Docker 5.6

> Cis Docker 5.6 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure sensitive host system directories are not mounted on containers

- Skill name: `cis-docker-5.6`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-5.6/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# 5.6 Ensure sensitive host system directories are not mounted on containers (Manual)

## Profile Applicability

- Level 1 - Docker - Linux

## Description

You should not allow sensitive host system directories such as those listed below to be mounted as container volumes, especially in read-write mode.

```
/
/boot
/dev
/etc
/lib
/lib64
/proc
/sys
/usr
```

## Rationale

If sensitive directories are mounted in read-write mode, it could be possible to make changes to files within them. This has obvious security implications and should be avoided.

## Impact

None.

## Audit Procedure

You should run the following command:

```bash
docker ps --quiet --all | xargs docker inspect --format='{{ .Id }}: Volumes={{ .Mounts }}'
```

This command returns a list of currently mapped directories and indicates whether they are mounted in read-write mode for each container instance.

## Remediation

You should not mount directories which are security sensitive on the host within containers, especially in read-write mode.

## Default Value

Docker defaults to using a read-write volume but you can also mount a directory read-only. By default, no sensitive host directories are mounted within containers.

## References

1. https://docs.docker.com/storage/volumes/

## CIS Controls

### v8

**3 Data Protection**

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

### v7

**13 Data Protection**

Data Protection

---

Source: https://www.openparable.com/skill/devops-security/cis-docker-5-6 (OpenParable). Cite the canonical URL above.