turbot/docker_compliance
GitHub
Loading controls...

Control: 6.2 Ensure that container sprawl is avoided

Description

You should not keep a large number of containers on the same host.

The flexibility of containers makes it easy to run multiple instances of applications and therefore indirectly leads to Docker images that can exist at varying security patch levels. It also means that you are consuming host resources that otherwise could have been used for running 'useful' containers. Having more than just an essential number of containers on a particular host makes the system vulnerable to mishandling, misconfiguration and fragmentation. You should therefore keep the number of containers on a given host to the minimum number commensurate with serving production applications.

Remediation

You should periodically check your container inventory on each host and clean up containers which are not in active use with the command below:

docker container prune

Default Value

By default, Docker does not restrict the number of containers you may have on a host.

Usage

Run the control in your terminal:

steampipe check docker_compliance.control.cis_v160_6_2

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share docker_compliance.control.cis_v160_6_2

SQL

This control uses a named query:

docker_info_container_sprawl_avoided

Tags