DKER-EE-002770 - Docker Enterprise container health must be checked at runtime.

Information

If the container image does not have an HEALTHCHECK instruction defined, use --health-cmd parameter at container runtime for checking container health.

One of the important security triads is availability. If the container image being used does not have a pre-defined HEALTHCHECK instruction, use the --health-cmd parameter to check container health at runtime. Based on the reported health status, take necessary actions.

By default, health checks are not done at container runtime.

Solution

Run the container using --health-cmd and the other parameters, or include the HEALTHCHECK instruction in the Dockerfiles.

Example:
docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|II, CCI|CCI-001095, Rule-ID|SV-235827r961155_rule, STIG-ID|DKER-EE-002770, STIG-Legacy|SV-104825, STIG-Legacy|V-95687, Vuln-ID|V-235827

Plugin: Unix

Control ID: 58917363890f3039474e73c3e2df3adfc0919b34554eb134b52a302e429cad4e