cis-docker-v170-6-2

name	cis-docker-v170-6.2
description	Ensure that container sprawl is avoided
category	cis-docker
version	1.7.0
author	cyberstrike-official
tags	["cis","docker","security-operations","containers","sprawl"]
cis_id	6.2
cis_benchmark	CIS Docker Benchmark v1.7.0
tech_stack	["docker"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Docker Benchmark v1.7.0 - Control 6.2

Profile Applicability

• Level: 1
• Type: Manual
• Platform: Docker - Linux

Description

You should not keep a large number of containers on the same host.

Rationale

The flexibility of containers makes it easy to run multiple instances of applications and therefore indirectly leads to Docker images that can exist at varying security patch levels. It also means that you are consuming host resources that otherwise could have been used for running 'useful' containers. Having more than just an essential number of containers on a particular host makes the system vulnerable to mishandling, misconfiguration and fragmentation. You should therefore keep the number of containers on a given host to the minimum number commensurate with serving production applications.

Impact

You should retain containers that are actively in use, and delete ones which are no longer needed.

Audit Procedure

Step 1 - Find the total number of containers you have on the host:

docker info --format '{{ .Containers }}'

Step 2 - Execute the commands below to find the total number of containers that are actually running or in the stopped state on the host.

docker info --format '{{ .ContainersStopped }}'
docker info --format '{{ .ContainersRunning }}'

If the difference between the number of containers that are stopped on the host and the number of containers that are actually running is excessive, you may be suffering from "Container sprawl" and should review the unused containers for potential deletion.

Remediation

You should periodically check your container inventory on each host and clean up containers which are not in active use with the command below:

docker container prune

Default Value

By default, Docker does not restrict the number of containers you may have on a host.

References

1. https://docs.docker.com/config/pruning/#prune-containers

CIS Controls

v8:

• 3.12 Segment Data Processing and Storage Based on Sensitivity
  • Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.