5.14 Ensure 'on-failure' container restart policy is set to '5' - 'MaximumRetryCount'

Information

Using the --restart flag in docker run command you can specify a restart policy for how a container should or should not be restarted on exit. You should choose the on-failure restart policy and limit the restart attempts to 5.
Rationale:
If you indefinitely keep trying to start the container, it could possibly lead to a denial of service on the host. It could be an easy way to do a distributed denial of service attack especially if you have many containers on the same host. Additionally, ignoring the exit status of the container and always attempting to restart the container leads to non-investigation of the root cause behind containers getting terminated. If a container gets terminated, you should investigate on the reason behind it instead of just attempting to restart it indefinitely. Thus, it is recommended to use on-failure restart policy and limit it to maximum of 5 restart attempts.

Solution

If a container is desired to be restarted of its own, then, for example, you could start the container as below:
docker run --detach --restart=on-failure:5 nginx
Impact:
The container would attempt to restart only for 5 times.
Default Value:
By default, containers are not configured with restart policies. Hence, containers do not attempt to restart of their own.

See Also

https://workbench.cisecurity.org/files/1726

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv6|18

Plugin: Unix

Control ID: 54edff05cb65e55af2c8947edb334548db1d96c752e9b62941641391627640a8