cis-docker-v160-2-1

name	cis-docker-v160-2.1
description	Run the Docker daemon as a non-root user, if possible
category	cis-docker
version	1.6.0
author	cyberstrike-official
tags	["cis","docker","daemon","rootless","privilege-reduction","security-hardening"]
cis_id	2.1
cis_benchmark	CIS Docker Benchmark v1.6.0
tech_stack	["docker"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Run the Docker daemon as a non-root user, if possible

Profile Applicability: Level 1 - Docker - Linux

Assessment Status: Manual

Description

Rootless mode executes the Docker daemon and containers inside a user namespace, with both the daemon and the container are running without root privileges.

Rationale

Rootless mode allows running the Docker daemon and containers as a non-root user to mitigate potential vulnerabilities in the daemon and the container runtime.

Impact

There are multiple prerequisites depending on which distribution that is in use, and also known limitations regarding networking and resource limitation.

Running in rootless mode also changes the location of any configuration files in use, including all containers using the daemon.

Audit Procedure

Running the following command will show any running dockerd processes and which user that is managing the daemon:

ps -fe | grep 'dockerd'

This command should show which user is running the dockerd process. If running in rootless mode, it should show a non-root user.

Remediation

Follow the current Docker documentation on how to install the Docker daemon as a non-root user.

Default Value

The Docker daemon is running as the root user by default.

References

1. https://docs.docker.com/engine/security/rootless/

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.1 Establish and Maintain a Secure Configuration Process Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.	●	●	●
v7	4 Controlled Use of Administrative Privileges Controlled Use of Administrative Privileges

Profile/Assessment Status

Profile: Level 1 - Docker - Linux Assessment Status: Manual