STIGQter STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Docker socket must not be mounted inside any containers.

DISA Rule

SV-260922r966123_rule

Vulnerability Number

V-260922

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000550

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration and using the -v/--volume flags to mount volumes to containers in a docker run command, do not use docker.sock as a volume.

A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.

Review and remove nonsystem containers previously created by these users without the runAsGroup must be removed using:

docker container rm [container]

Check Contents

If using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, log in to the CLI as an MKE Admin, and execute the following command using an MKE client bundle:

docker ps --all --filter "label=com.docker.ucp.version" | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep -i "docker.sock\|docker_engine"

If the Docker socket is mounted inside containers, this is a finding.

If "volumes" is not present or if "docker.sock" is listed, this is a finding.

Vulnerability Number

V-260922

Documentable

False

Rule Version

CNTR-MK-000550

Severity Override Guidance

If using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, log in to the CLI as an MKE Admin, and execute the following command using an MKE client bundle:

docker ps --all --filter "label=com.docker.ucp.version" | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep -i "docker.sock\|docker_engine"

If the Docker socket is mounted inside containers, this is a finding.

If "volumes" is not present or if "docker.sock" is listed, this is a finding.

Check Content Reference

M

Target Key

5595