Security benchmarks (CIS Docker) - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the CIS Docker Benchmark?

The CIS Docker Benchmark provides a set of best practices and security guidelines to help secure Docker containers and the Docker host environment.

intermediate

Name one key recommendation from the CIS Docker Benchmark related to Docker daemon configuration.

One key recommendation is to enable Docker Content Trust to ensure image authenticity and integrity during pull and push operations.

beginner

Why should you avoid running containers with the root user according to CIS Docker Benchmark?

Running containers as root increases the risk of privilege escalation and potential host compromise. The benchmark recommends using non-root users inside containers.

intermediate

What is the recommended action regarding Docker socket exposure in the CIS Docker Benchmark?

The benchmark advises not to expose the Docker socket (/var/run/docker.sock) to containers as it grants full control over the Docker daemon and host.

intermediate

How does the CIS Docker Benchmark suggest managing container resource limits?

It recommends setting resource limits like CPU and memory to prevent containers from exhausting host resources and affecting other containers.

What does the CIS Docker Benchmark primarily focus on?

A Increasing Docker build speed

B Optimizing Docker network performance

C Adding new Docker features

D Improving Docker container security

The CIS Docker Benchmark provides security best practices to protect Docker containers and hosts.

According to CIS Docker Benchmark, which user should containers avoid running as?

A root

B nobody

C docker

D admin

Running containers as root can lead to security risks; non-root users are recommended.

Why should the Docker socket not be exposed to containers?

A It slows down container startup

B It grants full control over the Docker daemon and host

C It causes network conflicts

D It increases image size

Exposing the Docker socket allows containers to control the Docker daemon, risking host security.

What is Docker Content Trust used for according to CIS Docker Benchmark?

A Verifying image authenticity and integrity

B Monitoring container performance

C Managing container logs

D Encrypting container data

Docker Content Trust ensures images are signed and verified before use.

What resource limits does CIS Docker Benchmark recommend setting for containers?

A Network bandwidth only

B Disk space only

C CPU and memory

D No limits are recommended

Setting CPU and memory limits prevents containers from overusing host resources.

Explain the importance of running Docker containers as non-root users according to the CIS Docker Benchmark.

Think about how root access inside containers can affect the host system.

Describe why exposing the Docker socket to containers is discouraged in the CIS Docker Benchmark.

Consider what control the Docker socket gives to a container.