Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Docker Enterprise default ulimit must not be overwritten at runtime unless approved in the System Security Plan (SSP).
Description
Discussion Text
The default ulimit is set at the Docker daemon level. However, override the default ulimit setting, if needed, during container runtime.
ulimit provides control over the resources available to the shell and to processes started by it. Setting system resource limits judiciously prevents many disasters such as a fork bomb. Sometimes, even friendly users and legitimate processes can overuse system resources and in-turn can make the system unusable.
The default ulimit set at the Docker daemon level should be honored. If the default ulimit settings are not appropriate for a particular container instance, override them as an exception. But, do not make this a practice. If most of the container instances are overriding default ulimit settings, consider changing the default ulimit settings to something that is appropriate for your needs.
If the ulimits are not set properly, the desired resource control might not be achieved and might even make the system unusable.
Container instances inherit the default ulimit settings set at the Docker daemon level.
ulimit provides control over the resources available to the shell and to processes started by it. Setting system resource limits judiciously prevents many disasters such as a fork bomb. Sometimes, even friendly users and legitimate processes can overuse system resources and in-turn can make the system unusable.
The default ulimit set at the Docker daemon level should be honored. If the default ulimit settings are not appropriate for a particular container instance, override them as an exception. But, do not make this a practice. If most of the container instances are overriding default ulimit settings, consider changing the default ulimit settings to something that is appropriate for your needs.
If the ulimits are not set properly, the desired resource control might not be achieved and might even make the system unusable.
Container instances inherit the default ulimit settings set at the Docker daemon level.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.