Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Docker Enterprise sensitive host system directories must not be mounted on containers.
Description
Discussion Text
Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in read-write mode.
Linux:
/
/boot
/dev
/etc
/lib
/proc
/sys
/usr
Windows:
%windir% (C:\Windows)
%windir%\system32 (C:\Windows\system32)
%programdata%
%programData%\docker
C:\Program Files
C:\Program Files (x86)
C:\Users
If sensitive directories are mounted in read-write mode, it would be possible to make changes to files within those sensitive directories. The changes might bring down security implications or unwarranted changes that could put the Docker host in compromised state.
Docker defaults to a read-write volume but the user can also mount a directory read-only. By default, no sensitive host directories are mounted on containers.
Linux:
/
/boot
/dev
/etc
/lib
/proc
/sys
/usr
Windows:
%windir% (C:\Windows)
%windir%\system32 (C:\Windows\system32)
%programdata%
%programData%\docker
C:\Program Files
C:\Program Files (x86)
C:\Users
If sensitive directories are mounted in read-write mode, it would be possible to make changes to files within those sensitive directories. The changes might bring down security implications or unwarranted changes that could put the Docker host in compromised state.
Docker defaults to a read-write volume but the user can also mount a directory read-only. By default, no sensitive host directories are mounted on containers.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.