DKER-EE-003200 - Docker Enterprise images must be built with the USER instruction to prevent containers from running as root.

Information

Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. Apply an applicable set of role-based access control (RBAC) policies using the built-in capabilities provided by UCP in order to prevent organization-defined software from executing at higher privilege levels than users executing the software.

By default, Docker images that are built without the USER instruction will be run as containers as root. Therefore, it is imperative that container images include the USER instruction and that the referenced UID/GID has been defined in the base image or previous instruction set.

Solution

Set a non-root user for all container images.

Include the following line in all Dockerfiles where username or ID refers to the user that can be found in the container base image or one that is created as part of that same Dockerfile:

USER [username/ID]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(8), CAT|II, CCI|CCI-002233, Rule-ID|SV-235830r961359_rule, STIG-ID|DKER-EE-003200, STIG-Legacy|SV-104831, STIG-Legacy|V-95693, Vuln-ID|V-235830

Plugin: Unix

Control ID: 3c981fd1d4aa0e8dd0ba8626d19e5dc5a0d4770eaed6e809b1581b22f2fb7a75