Cis Docker 7.9
DevOps & Securitycis-docker-7.9Cis Docker 7.9 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that management plane traffic is separated from data plane traffic
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-7.9/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-7-9, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
7.9 Ensure that management plane traffic is separated from data plane traffic (Manual)
Profile Applicability
- Level 1 - Docker Swarm
Description
You should separate management plane traffic from data plane traffic.
Rationale
Separating management plane traffic from data plane traffic ensures that these types of traffic are segregated from each other. These traffic flows can then be individually monitored and tied to different traffic control policies and monitoring. This also ensures that the management plane is always reachable even if there is a great deal of traffic on the data plane.
Impact
This requires two network interfaces per node.
Audit Procedure
You should run the command below on each swarm node and ensure that the management plane address is not the same as the data plane address.
docker node inspect --format '{{ .Status.Addr }}' self
Remediation
You should initialize the swarm with dedicated interfaces for management and data planes respectively.
For example,
docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3
Default Value
By default, data plane traffic is not separated from management plane traffic.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 12 Network Infrastructure ManagementEstablish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points. | |||
| v7 | 14.1 Segment the Network Based on SensitivitySegment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs). | ● | ● |