DKER-EE-002050 - Mount propagation mode must not set to shared in Docker Enterprise.

Information

Mount propagation mode allows mounting volumes in shared, slave or private mode on a container. Do not use shared mount propagation mode until needed.

A shared mount is replicated at all mounts and the changes made at any mount point are propagated to all mounts. Mounting a volume in shared mode does not restrict any other container to mount and make changes to that volume. This unintended volume changes could potentially impact data hosted on the mounted volume. Do not set mount propagation mode to shared until needed.

By default, the container mounts are private.

Solution

Do not mount volumes in shared mode propagation.

For example, do not start container as below:

docker run <Run arguments> --volume=/hostPath:/containerPath:shared <Container Image Name or ID> <Command>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-235810r960963_rule, STIG-ID|DKER-EE-002050, STIG-Legacy|SV-104793, STIG-Legacy|V-95655, Vuln-ID|V-235810

Plugin: Unix

Control ID: 9822fc08e9a199bf07e82b81708ed87b1a046aaa40c8a7bb4c7717704d26af17