Cis Docker V170 2.3
DevOps & Securitycis-docker-v170-2.3Cis Docker V170 2.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure the logging level is set to 'info'
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.7.0/cis-docker-v170-2.3/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-v170-2-3, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS Docker Benchmark v1.7.0 - Control 2.3
Profile Applicability
- Level: 1 - Docker - Linux
Description
Set Docker daemon log level to info.
Rationale
Setting up an appropriate log level, configures the Docker daemon to log events that you would want to review later. A base log level of info and above would capture all logs except debug logs. Until and unless required, you should not run Docker daemon at debug log level.
Impact
None.
Audit Procedure
To confirm this setting a combination of reviewing the dockerd start-up options and a review of any settings in /etc/docker/daemon.json should be completed.
To review the dockerd startup options, use:
ps -ef | grep dockerd
Ensure that either the --log-level parameter is not present or if present, then it is set to info.
The contents of /etc/docker/daemon.json should also be reviewed for this setting.
Remediation
Ensure that the Docker daemon configuration file has the following configuration included:
"log-level": "info"
Alternatively, run the Docker daemon as below:
dockerd --log-level="info"
Default Value
By default, Docker daemon is set to log level of info.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit LogsConfigure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | ● | ● | |
| v7 | 6.2 Activate audit loggingEnsure that local logging has been enabled on all systems and networking devices. | ● | ● | ● |
| v7 | 6.3 Enable Detailed LoggingEnable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. | ● | ● |
Profile
Level 1 - Docker - Linux (Manual)