Cis Docker V160 2.10
DevOps & Securitycis-docker-v160-2.10Cis Docker V160 2.10 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure the default cgroup usage has been confirmed
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.6.0/cis-docker-v160-2.10/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-v160-2-10, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure the default cgroup usage has been confirmed
Profile Applicability: Level 2 - Docker - Linux
Assessment Status: Manual
Description
The --cgroup-parent option allows you to set the default cgroup parent to use for all containers. If there is no specific usage requirement for this, the setting should be left at its default.
Rationale
System administrators typically define cgroups under which containers are supposed to run. Even if cgroups are not explicitly defined by the system administrators, containers run under docker cgroup by default.
It is possible to attach to a different cgroup other than the one which is the default, however this type of usage should be monitored and confirmed because attaching to a different cgroup other than the one that is a default, it could be possible to share resources unevenly causing resource utilization problems on the host.
Impact
None.
Audit Procedure
In order to confirm this setting, the dockerd start-up options and any settings in /etc/docker/daemon.json should be reviewed.
To review the dockerd startup options, use:
ps -ef | grep dockerd
You should ensure that the --cgroup-parent parameter is either not set or is set as appropriate non-default cgroup.
The contents of /etc/docker/daemon.json should also be checked for this setting.
Remediation
The default setting is in line with good security practice and can be left in situ. If you wish to specifically set a non-default cgroup, pass the --cgroup-parent parameter to the Docker daemon when starting it.
For example,
dockerd --cgroup-parent=/foobar
Default Value
By default, docker daemon uses /docker for fs cgroup driver and system.slice for systemd cgroup driver.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6 Access Control ManagementUse processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software. | |||
| v7 | 18 Application Software SecurityApplication Software Security |
Profile/Assessment Status
Profile: Level 2 - Docker - Linux Assessment Status: Manual