cyberstrikeus Run the Docker daemon as a non-root user, if possible
Profile Applicability: Level 1 - Docker - Linux
Assessment Status: Manual
Description
Rootless mode executes the Docker daemon and containers inside a user namespace, with both the daemon and the container are running without root privileges.
Rationale
Rootless mode allows running the Docker daemon and containers as a non-root user to mitigate potential vulnerabilities in the daemon and the container runtime.
Impact
There are multiple prerequisites depending on which distribution that is in use, and also known limitations regarding networking and resource limitation.
Running in rootless mode also changes the location of any configuration files in use, including all containers using the daemon.
Audit Procedure
Running the following command will show any running dockerd processes and which user that is managing the daemon:
ps -fe | grep 'dockerd'
This command should show which user is running the dockerd process. If running in rootless mode, it should show a non-root user.
Remediation
Follow the current Docker documentation on how to install the Docker daemon as a non-root user.
Default Value
The Docker daemon is running as the root user by default.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.1 Establish and Maintain a Secure Configuration ProcessEstablish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. | ● | ● | ● |
| v7 | 4 Controlled Use of Administrative PrivilegesControlled Use of Administrative Privileges |
Profile/Assessment Status
Profile: Level 1 - Docker - Linux Assessment Status: Manual