Containers should not share the host's user namespaces

docker

Classification:

compliance

Framework:

cis-docker

Control:

5.30

Set up the docker integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

You should not share the host’s user namespaces with containers running on it.

Rationale

User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container does not therefore isolate users on the host from users in the containers.

Audit

Run this command and ensure that it does not return any value for UsernsMode. If it returns a value of host, it means that the host user namespace is shared with its containers: docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}'

Remediation

Do not share user namespaces between host and containers. For example, do not run the command docker run --rm -it --userns=host ubuntu bash

Impact

None

Default value

By default, the host user namespace is shared with containers unless user namespace support is enabled.

References

  1. https://docs.docker.com/engine/security/userns-remap/
  2. https://docs.docker.com/engine/reference/commandline/run/#options
  3. https://github.com/docker/docker/pull/12648
  4. https://events.linuxfoundation.org/sites/events/files/slides/User%20Namespaces%20-%20ContainerCon%202015%20-%2016-9-final_0.pdf

CIS controls

Version 6

12 Boundary Defense Boundary Defense