Control: 6.2 Ensure that container sprawl is avoided
You should not keep a large number of containers on the same host.
The flexibility of containers makes it easy to run multiple instances of applications and therefore indirectly leads to Docker images that can exist at varying security patch levels. It also means that you are consuming host resources that otherwise could have been used for running 'useful' containers. Having more than just an essential number of containers on a particular host makes the system vulnerable to mishandling, misconfiguration and fragmentation. You should therefore keep the number of containers on a given host to the minimum number commensurate with serving production applications.
You should periodically check your container inventory on each host and clean up containers which are not in active use with the command below:
docker container prune
By default, Docker does not restrict the number of containers you may have on a host.
Run the control in your terminal:
steampipe check docker_compliance.control.cis_v160_6_2
Snapshot and share results via Steampipe Cloud:
steampipe loginsteampipe check --share docker_compliance.control.cis_v160_6_2
This control uses a named query:docker_info_container_sprawl_avoided