DKER-EE-002010 - Memory usage for all containers must be limited in Docker Enterprise.

Information

By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of Docker host, such as memory limit, the amount of memory that a container may consume can be controlled.

By default, container can use all of the memory on the host. The user can use memory limit mechanism to prevent a denial of service arising from one container consuming all of the host's resources such that other containers on the same host cannot perform their intended functions. Having no limit on memory can lead to issues where one container can easily make the whole system unstable, and as a result, unusable.

By default, all containers on a Docker host share the resources equally. No memory limits are enforced.

Solution

Document container memory requirements in the System Security Plan (SSP).

Run the container with only as much memory as required. Always run the container using the --memory argument.

For example, run a container as below:

docker run --interactive --tty --memory 256m centos /bin/bash

In the above example, the container is started with a memory limit of 256 MB.

Note: The output of the below command would return values in scientific notation if memory limits are in place.

docker inspect --format='{{.Config.Memory}}' 7c5a2d4c7fe0

For example, if the memory limit is set to 256 MB for the above container instance, the output of the above command would be 2.68435456e+08 and NOT 256m. Convert this value using a scientific calculator or programmatic methods.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-235806r960963_rule, STIG-ID|DKER-EE-002010, STIG-Legacy|SV-104785, STIG-Legacy|V-95647, Vuln-ID|V-235806

Plugin: Unix

Control ID: 1ac2e52bdbf1003b99d23de370e7068b8f495a6ec1b71ed740e0a11f0da67083