OpenParable
Skip to content
← Back to skills

Cis Docker V170 5.27

DevOps & Security
cis-docker-v170-5.27

Cis Docker V170 5.27 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure that container health is checked at runtime

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.7.0/cis-docker-v170-5.27/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-v170-5-27, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

CIS Docker Benchmark v1.7.0 - Control 5.27

Profile Applicability

  • Level: 1
  • Type: Manual
  • Platform: Docker - Linux

Description

If the container image does not have an HEALTHCHECK instruction defined, you should use the --health-cmd parameter at container runtime to check container health.

Rationale

If the container image you are using does not have a pre-defined HEALTHCHECK instruction, use the --health-cmd parameter to check container health at runtime.

Based on the reported health status, remedial actions can be taken if necessary.

Impact

None.

Audit Procedure

You should run the command below and ensure that all containers are reporting their health status:

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Health={{ .State.Health.Status }}'

Remediation

You should run the container using the --health-cmd parameter.

For example:

docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx

Default Value

By default, health checks are not carried out at container runtime.

References

  1. https://docs.docker.com/engine/reference/run/#healthcheck

CIS Controls

v8:

  • 10.5 Enable Anti-Exploitation Features
    • Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

v7:

  • 3.1 Run Automated Vulnerability Scanning Tools
    • Utilize an up-to-date SCAP-compliant vulnerability scanning tool to automatically scan all systems on the network on a weekly or more frequent basis to identify all potential vulnerabilities on the organization's systems.