| 1.1.8 Ensure auditing is configured for Docker files and directories - containerd.sock | CIS Docker v1.6.0 L2 Docker Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.15 Ensure auditing is configured for Docker files and directories - /usr/bin/containerd-shim | CIS Docker v1.6.0 L2 Docker Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1 Restrict network traffic between containers | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2 Ensure network traffic is restricted between containers on the default bridge | CIS Docker v1.6.0 L1 Docker Linux | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Ensure aufs storage driver is not used | CIS Docker v1.6.0 L1 Docker Linux | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.7 Set default ulimit as appropriate - default-ulimit | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.8 Enable user namespace support | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | |
| 2.8 Ensure the default ulimit is configured appropriately - daemon.json nofile soft | CIS Docker v1.6.0 L1 Docker Linux | Unix | CONFIGURATION MANAGEMENT |
| 2.12 Ensure that authorization for Docker client commands is enabled - dockerd | CIS Docker v1.6.0 L2 Docker Linux | Unix | |
| 2.16 Control the number of manager nodes in a swarm | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.16 Ensure Userland Proxy is Disabled | CIS Docker v1.6.0 L1 Docker Linux | Unix | CONFIGURATION MANAGEMENT |
| 2.16 Ensure Userland Proxy is Disabled - dockerd | CIS Docker v1.6.0 L1 Docker Linux | Unix | |
| 2.17 Bind swarm services to a specific host interface | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1 Ensure that the docker.service file ownership is set to root:root | CIS Docker v1.6.0 L1 Docker Linux | Unix | ACCESS CONTROL |
| 3.1 Verify that docker.service file ownership is set to root:root | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.2 Ensure that docker.service file permissions are appropriately set | CIS Docker v1.6.0 L2 Docker Linux | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.3 Ensure that docker.socket file ownership is set to root:root | CIS Docker v1.6.0 L2 Docker Linux | Unix | ACCESS CONTROL |
| 3.19 Verify that TLS CA certificate file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.23 Ensure that the Containerd socket file ownership is set to root:root | CIS Docker v1.6.0 L1 Docker Linux | Unix | ACCESS CONTROL |
| 4.3 Do not install unnecessary packages in the container | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.3 Do not install unnecessary packages in the container | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.8 Ensure setuid and setgid permissions are removed | CIS Docker v1.6.0 L2 Docker Linux | Unix | ACCESS CONTROL |
| 4.9 Use COPY instead of ADD in Dockerfile | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.1 Verify AppArmor | CIS Docker 1.6 v1.0.0 L2 Docker | Unix | ACCESS CONTROL |
| 5.4 Do not use privileged containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | ACCESS CONTROL |
| 5.5 Do not mount sensitive host system directories on containers | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.5 Do not use privileged containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.5 Ensure that privileged containers are not used | CIS Docker v1.6.0 L1 Docker Linux | Unix | ACCESS CONTROL |
| 5.6 Do not run ssh within containers | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.8 Open only needed ports on container | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.15 Do not share the host's process namespace | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.15 Set the 'on-failure' container restart policy to 5 - RestartPolicyName=always | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.17 Do not directly expose host devices to containers | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.19 Do not set mount propagation mode to shared | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.20 Do not share the host's UTS namespace | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.24 Confirm cgroup usage | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.30 Do not share the host's user namespaces | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1 Perform regular security audits of your host system and containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 6.1 Perform regular security audits of your host system and containers | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | |
| 6.2 Monitor Docker containers usage, performance and metering | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 6.2 Monitor Docker containers usage, performance and metering | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 6.3 Endpoint protection platform (EPP) tools for containers (Not Scored) | CIS Docker 1.6 v1.0.0 L2 Docker | Unix | |
| 7.9 Ensure that management plane traffic is separated from data plane traffic | CIS Docker v1.6.0 L1 Docker Swarm | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| Check if this is a Docker Vessel/Host | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| Check if this is a Docker Vessel/Host | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | |
| Check if this is a Docker Vessel/Host | CIS Docker 1.11.0 v1.0.0 L2 Docker | Unix | |
| Check to see if Swarm is active | CIS Docker v1.6.0 L1 Docker Swarm | Unix | |
| CIS_Docker_1.6_v1.0.0_L1_Docker.audit Level 1 | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| CIS_Docker_1.11.0_v1.0.0_L2.audit Level 2 | CIS Docker 1.11.0 v1.0.0 L2 Docker | Unix | |
| Ubuntu is installed | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
