CyberStrikeus/CyberStrike - Page 42

cis-docker-3-2

Ensure that docker.service file permissions are appropriately set

cis-docker-3-20

Ensure that the /etc/default/docker file permissions are set to 644 or more restrictively

cis-docker-3-21

Ensure that the /etc/sysconfig/docker file permissions are set to 644 or more restrictively

cis-docker-3-22

Ensure that the /etc/sysconfig/docker file ownership is set to root:root

cis-docker-3-23

Ensure that the Containerd socket file ownership is set to root:root

cis-docker-3-24

Ensure that the Containerd socket file permissions are set to 660 or more restrictively

cis-docker-3-3

Ensure that docker.socket file ownership is set to root:root

cis-docker-3-4

Ensure that docker.socket file permissions are set to 644 or more restrictive

cis-docker-3-5

Ensure that the /etc/docker directory ownership is set to root:root

cis-docker-3-6

Ensure that /etc/docker directory permissions are set to 755 or more restrictively

cis-docker-3-7

Ensure that registry certificate file ownership is set to root:root

cis-docker-3-8

Ensure that registry certificate file permissions are set to 444 or more restrictively

cis-docker-3-9

Ensure that TLS CA certificate file ownership is set to root:root

cis-docker-5-17

Ensure that the host's IPC namespace is not shared

cis-docker-5-18

Ensure that host devices are not directly exposed to containers

cis-docker-5-19

Ensure that the default ulimit is overwritten at runtime if needed

cis-docker-5-20

Ensure mount propagation mode is not set to shared

cis-docker-5-21

Ensure that the host's UTS namespace is not shared

cis-docker-5-22

Ensure the default seccomp profile is not Disabled

cis-docker-5-23

Ensure that docker exec commands are not used with the privileged option

cis-docker-5-24

Ensure that docker exec commands are not used with the user=root option

cis-docker-5-25

Ensure that cgroup usage is confirmed

cis-docker-5-26

Ensure that the container is restricted from acquiring additional privileges

cis-docker-5-27

Ensure that container health is checked at runtime

cis-docker-5-28

Ensure that Docker commands always make use of the latest version of their image

cis-docker-5-29

Ensure that the PIDs cgroup limit is used

cis-docker-5-30

Ensure that Docker's default bridge docker0 is not used

cis-docker-5-31

Ensure that the host's user namespaces are not shared

cis-docker-5-32

Ensure that the Docker socket is not mounted inside any containers

cis-docker-6-1

Ensure that image sprawl is avoided

cis-docker-6-2

Ensure that container sprawl is avoided

cis-docker-7-1

Ensure that the minimum number of manager nodes have been created in a swarm

cis-docker-7-2

Ensure that swarm services are bound to a specific host interface

cis-docker-7-3

Ensure that all Docker swarm overlay networks are encrypted

cis-docker-7-4

Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster

cis-docker-7-5

Ensure that swarm manager is run in auto-lock mode

cis-docker-7-6

Ensure that the swarm manager auto-lock key is rotated periodically

cis-docker-7-7

Ensure that node certificates are rotated as appropriate

cis-docker-7-8

Ensure that CA certificates are rotated as appropriate

cis-docker-7-9

Ensure that management plane traffic is separated from data plane traffic