cyberstrikeus 5.14 Ensure that incoming container traffic is bound to a specific host interface (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
By default, Docker containers can make connections to the outside world, but the outside world cannot connect to containers; each outgoing connection will appear to originate from one of the host machine's own IP addresses. You should only allow container services to be contacted through a specific external interface on the host machine.
Rationale
If you have multiple network interfaces on your host machine, the container can accept connections on exposed ports on any network interface. This might not be desirable and may not be secured. In many cases a specific, desired interface is exposed externally and services such as intrusion detection, intrusion prevention, firewall, load balancing, etc. are all run by intention there to screen incoming public traffic. You should therefore not accept incoming connections on any random interface, but only the one designated for this type of traffic.
Impact
None.
Audit Procedure
You should list all running instances of containers and their port mappings by executing the command below:
docker ps --quiet | xargs docker inspect --format='{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'
Then review the list and ensure that the exposed container ports are bound to a specific interface and not to the wildcard IP address 0.0.0.0.
For example, if the command above returns results below, this is non-compliant and the container can accept connections on any host interface on the specified port 49153.
Ports=map[443/tcp:<nil> 80/tcp:[map[HostPort:49153 HostIp:0.0.0.0]]]
However, if the exposed port is bound to a specific interface on the host as below, then this is configured in line with good security practice.
Ports=map[443/tcp:<nil> 80/tcp:[map[HostIp:10.2.3.4 HostPort:49153]]]
Remediation
You should bind the container port to a specific host interface on the desired host port. For example,
docker run --detach --publish 10.2.3.4:49153:80 nginx
In the example above, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from the 10.2.3.4 external interface.
Default Value
By default, Docker exposes the container ports on 0.0.0.0, the wildcard IP address that will match any possible incoming network interface on the host machine.
References
CIS Controls
v8
4.4 Implement and Manage a Firewall on Servers
Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.
v7
11 Secure Configuration for Network Devices, such as Firewalls, Routers and Switches
Secure Configuration for Network Devices, such as Firewalls, Routers and Switches