5.1 Ensure swarm mode is not Enabled, if not needed

Information

Do not enable swarm mode on a Docker engine instance unless this is needed.

Rationale:

By default, a Docker engine instance will not listen on any network ports, with all communications with the client coming over the Unix socket. When Docker swarm mode is enabled on a Docker engine instance, multiple network ports are opened on the system and made available to other systems on the network for the purposes of cluster management and node communications.

Opening network ports on a system increases its attack surface and this should be avoided unless required.

It should be noted that swarm mode is required for the operation of Docker Enterprise components.

Impact:

Disabling swarm mode will impact the operation of Docker Enterprise components if these are in use.

Solution

If swarm mode has been enabled on a system in error, you should run the command below:

docker swarm leave

Default Value:

By default, Docker swarm mode is not enabled.

See Also

https://workbench.cisecurity.org/files/4532

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 3c1f91a0c3d6ff0d2750f9ba674a30ba668fe41a1415cddbe81a9115f32eb466