STIGQter: STIG Summary: Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The on-failure container restart policy must be is set to 5 in Docker Enterprise.

DISA Rule

SV-235843r627656_rule

Vulnerability Number

V-235843

Group Title

SRG-APP-000435

Rule Version

DKER-EE-004030

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

If a container is desired to be restarted on its own, then, for example, start the container as below:

docker run --detach --restart=on-failure:5 nginx

Check Contents

Ensure 'on-failure' container restart policy is set to 5.

via CLI:

Linux: As a Docker EE Admin, execute the following command using a Universal Control Plane (UCP) client bundle:

docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: RestartPolicyName={{ .HostConfig.RestartPolicy.Name }} MaximumRetryCount={{ .HostConfig.RestartPolicy.MaximumRetryCount }}'
If RestartPolicyName= "" and MaximumRetryCount=0, this is not a finding.

If RestartPolicyName=always, this is a finding.

If RestartPolicyName=on-failure, verify that the number of restart attempts is set to 5 or less by looking at MaximumRetryCount.

If RestartPolicyName=failure and MaximumRetryCount is > 5, this is a finding.

Vulnerability Number

V-235843

Documentable

False

Rule Version

DKER-EE-004030

Severity Override Guidance

Ensure 'on-failure' container restart policy is set to 5.

via CLI:

Linux: As a Docker EE Admin, execute the following command using a Universal Control Plane (UCP) client bundle:

docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: RestartPolicyName={{ .HostConfig.RestartPolicy.Name }} MaximumRetryCount={{ .HostConfig.RestartPolicy.MaximumRetryCount }}'
If RestartPolicyName= "" and MaximumRetryCount=0, this is not a finding.

If RestartPolicyName=always, this is a finding.

If RestartPolicyName=on-failure, verify that the number of restart attempts is set to 5 or less by looking at MaximumRetryCount.

If RestartPolicyName=failure and MaximumRetryCount is > 5, this is a finding.

Check Content Reference

M

Target Key

5281

Comments