cis-docker-5-14

name	cis-docker-5.14
description	Ensure that incoming container traffic is bound to a specific host interface
category	cis-docker
version	1.8.0
author	cyberstrike-official
tags	["cis","docker","linux","containers","runtime","networking","security"]
cis_id	5.14
cis_benchmark	CIS Docker Benchmark v1.8.0
tech_stack	["linux","docker"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.14 Ensure that incoming container traffic is bound to a specific host interface (Manual)

Profile Applicability

• Level 1 - Docker - Linux

Description

By default, Docker containers can make connections to the outside world, but the outside world cannot connect to containers; each outgoing connection will appear to originate from one of the host machine's own IP addresses. You should only allow container services to be contacted through a specific external interface on the host machine.

Rationale

If you have multiple network interfaces on your host machine, the container can accept connections on exposed ports on any network interface. This might not be desirable and may not be secured. In many cases a specific, desired interface is exposed externally and services such as intrusion detection, intrusion prevention, firewall, load balancing, etc. are all run by intention there to screen incoming public traffic. You should therefore not accept incoming connections on any random interface, but only the one designated for this type of traffic.

Impact

None.

Audit Procedure

You should list all running instances of containers and their port mappings by executing the command below:

docker ps --quiet | xargs docker inspect --format='{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Then review the list and ensure that the exposed container ports are bound to a specific interface and not to the wildcard IP address 0.0.0.0.

For example, if the command above returns results below, this is non-compliant and the container can accept connections on any host interface on the specified port 49153.

Ports=map[443/tcp:<nil> 80/tcp:[map[HostPort:49153 HostIp:0.0.0.0]]]

However, if the exposed port is bound to a specific interface on the host as below, then this is configured in line with good security practice.

Ports=map[443/tcp:<nil> 80/tcp:[map[HostIp:10.2.3.4 HostPort:49153]]]

Remediation

You should bind the container port to a specific host interface on the desired host port. For example,

docker run --detach --publish 10.2.3.4:49153:80 nginx

In the example above, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from the 10.2.3.4 external interface.

Default Value

By default, Docker exposes the container ports on 0.0.0.0, the wildcard IP address that will match any possible incoming network interface on the host machine.

References

1. https://docs.docker.com/network/