Cis Docker V160 1.1.2
DevOps & Securitycis-docker-v160-1.1.2Cis Docker V160 1.1.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure only trusted users are allowed to control Docker daemon
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.6.0/cis-docker-v160-1.1.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-v160-1-1-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS Docker Benchmark v1.6.0 - 1.1.2
Profile Applicability
- Level 1 - Docker - Linux
Description
The Docker daemon currently requires root access to the Docker socket which is, by default, owned by the user root and the group docker.
Rationale
Docker allows you to share a directory between the Docker host and a guest container without limiting the access rights of the container. This means that you can start a container and map the / directory on your host to the container. The container would then be able to modify your host file system without any restrictions. This means that you could gain elevated privileges simply by being a member of the docker group and subsequently start a container which maps the root / directory on the host.
Impact
Provided the proceeding instructions are implemented, rights to build and execute containers as normal user would be restricted.
Audit Procedure
Execute the following command on the docker host and ensure that only trusted users are members of the docker group.
getent group docker
Remediation
You should remove any untrusted users from the docker group. Additionally, you should not create a mapping of sensitive directories from the host to container volumes.
Default Value
Not Applicable
References
- https://docs.docker.com/engine/security/#docker-daemon-attack-surface
- http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.1 Establish an Access Granting ProcessEstablish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user. | ● | ● | ● |
| v7 | 4 Controlled Use of Administrative PrivilegesControlled Use of Administrative Privileges |
Assessment Status
Manual
Additional Information
N/A