2.3 Allow Docker to make changes to iptables

Information

Iptables are used to set up, maintain, and inspect the tablesof IP packet filter rules in the Linux kernel. Allow the Docker daemon to make changes to the iptables.

Rationale:

Docker will never make changes to your system iptables rules if you choose to do so. Docker server would automatically make the needed changes to iptables based on how you choose your networking options for the containers if it is allowed to do so. It is recommended to let Docker server make changes to iptables automatically to avoid networking misconfiguration that might hamper the communication between containers and to the outside world. Additionally, it would save you hassles of updating iptables every time you choose to run the containers or modify networking options.

Solution

Do not run the Docker daemon with '--iptables=false' parameter.



For example, do not start the Docker daemon as below:

dockerd--iptables=false

Impact:

None.

Default Value:

By default, 'iptables' is set to 'true'.

See Also

https://workbench.cisecurity.org/files/1476

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(12)

Plugin: Unix

Control ID: 6b9d7106059401e80d59fa9850c40f85a50ad89c773ebe7226a7a9a477fca7ca