Detections
Analytics
5.9 Ensure that only needed ports are open on the container
Information
The dockerfile for a container image defines the ports which are opened by default on a container instance. The list of ports are relevant to the application you are running within the container and should only be open if they are needed.Rationale:
A container can be run with only the ports defined in the Dockerfile for its image or can alternatively be arbitrarily passed run time parameters to open a list of ports. Additionally, in the course of time, the Dockerfile may undergo various changes and the list of exposed ports may or may not still be relevant to the application you are running within the container. Opening unneeded ports increases the attack surface of the container and the associated containerized application. Good security practice is to only open ports that are needed for the correct operation of the application.
Impact:
None.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
You should ensure that the Dockerfile for each container image only exposes needed ports. You can also completely ignore the list of ports defined in the Dockerfile by NOT using -P (UPPERCASE) or the --publish-all flag when starting the container. Instead, use the -p (lowercase) or --publish flag to explicitly define the ports that you need for a particular container instance.For example:
docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash
Default Value:
By default, all the ports that are listed in the Dockerfile under the EXPOSE instruction for an image are opened when a container is run with the -P or --publish-all flags.
See Also
Item Details
Audit Name: CIS Docker v1.6.0 L1 Docker Linux
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: c2dad0839600d28580571bf50126540474ddd46d3252c42a7aa9b2845a173222