Cis Docker 6.2
DevOps & Securitycis-docker-6.2Cis Docker 6.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that container sprawl is avoided
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-6.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-6-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
6.2 Ensure that container sprawl is avoided (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
You should not keep a large number of containers on the same host.
Rationale
The flexibility of containers makes it easy to run multiple instances of applications and therefore indirectly leads to Docker images that can exist at varying security patch levels. It also means that you are consuming host resources that otherwise could have been used for running 'useful' containers. Having more than just an essential number of containers on a particular host makes the system vulnerable to mishandling, misconfiguration and fragmentation. You should therefore keep the number of containers on a given host to the minimum number commensurate with serving production applications.
Impact
You should retain containers that are actively in use, and delete ones which are no longer needed.
Audit Procedure
Step 1 - Find the total number of containers you have on the host:
docker info --format '{{ .Containers }}'
Step 2 - Execute the commands below to find the total number of containers that are actually running or in the stopped state on the host.
docker info --format '{{ .ContainersStopped }}'
docker info --format '{{ .ContainersRunning }}'
If the difference between the number of containers that are stopped on the host and the number of containers that are actually running is excessive, you may be suffering from "Container sprawl" and should review the unused containers for potential deletion.
Remediation
You should periodically check your container inventory on each host and clean up containers which are not in active use with the command below:
docker container prune
Default Value
By default, Docker does not restrict the number of containers you may have on a host.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.12 Segment Data Processing and Storage Based on SensitivitySegment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data. | ● | ● | |
| v8 | 4 Secure Configuration of Enterprise Assets and SoftwareEstablish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications). | |||
| v7 | 5.1 Establish Secure ConfigurationsMaintain documented, standard security configuration standards for all authorized operating systems and software. | ● | ● | ● |