2.7 Set default ulimit as appropriate

Information

Set the default ulimit options as appropriate in your environment.

Rationale:

ulimit provides control over the resources available to the shell and to processes started by it. Setting system resource limits judiciously saves you from many disasters such as afork bomb. Sometimes, even friendly users and legitimate processes can overuse system resources and in-turn can make the system unusable.

Setting default ulimit for the Docker daemon would enforce the ulimit for all container instances. You would not need to setup ulimit for each container instance. However, the default ulimit can be overridden during container runtime, if needed. Hence, to control the system resources, define a default ulimit as needed in your environment.

Solution

Run the docker in daemon mode and pass '--default-ulimit' as argument with respective ulimits as appropriate in your environment.

For Example,

dockerd --default-ulimit nproc=1024:2408 --default-ulimit nofile=100:200

Impact:

If the ulimits are not set properly, the desired resource control might not be achieved and might even make the system unusable.

Default Value:

By default, no ulimit is set.

See Also

https://workbench.cisecurity.org/files/1476

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-6

Plugin: Unix

Control ID: bf45806bc00aef11931f9e90d4dd2eb604f5837782f2cf71943ac2ad2d838b78