5.14 Set the 'on-failure' container restart policy to 5 - RestartPolicyName=always

Information

Using the '--restart' flag in 'docker run' command you can specify a restart policy for
how a container should or should not be restarted on exit. You should choose the 'on-
failure' restart policy and limit the restart attempts to 5.If you indefinitely keep trying to start the container, it could possibly lead to a denial of
service on the host. It could be an easy way to do a distributed denial of service attack
especially if you have many containers on the same host. Additionally, ignoring the exit
status of the container and 'always' attempting to restart the container leads to non-
investigation of the root cause behind containers getting terminated. If a container gets
terminated, you should investigate on the reason behind it instead of just attempting to
restart it indefinitely. Thus, it is recommended to use 'on-failure' restart policy and limit
it to maximum of 5 restart attempts.

Solution

If a container is desired to be restarted of its own, then start the container as below-$> docker run <Run arguments> --restart=on-failure-5 <Container Image Name or ID>
<Command>
For example,docker run --detach --restart=on-failure-5 nginxImpact-The container would attempt to restart only for 5 times.Default Value-By default, containers are not configured with restart policies. Hence, containers do not
attempt to restart of their own.

See Also

https://workbench.cisecurity.org/files/517

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5

Plugin: Unix

Control ID: b5bbccb4873ac2ad73b69ed680c3550e683eb53bd4eb4f09e911ed5c2af8effe