docker-ce-cis-baseline/inspec.yml at master · mitre/docker-ce-cis-baseline · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: docker-ce-cis-baseline
title: docker-ce-cis-baseline
maintainer: MITRE InSpec Team
copyright: The MITRE Corporation, 2018
copyright_email: inspec_support@mitre.org
license: Apache-2.0
summary: 'InSpec Validation Profile for CIS Docker CIS'
version: 1.1.1
inspec_version: ">= 4.0"

inputs:
  - name: trusted_user
    description: 'Trusted system user'
    type: string
    sensitive: true
    value: 'vagrant'

  - name: managable_container_number
    description: 'Number of managable docker containers'
    type: numeric
    value: 25

  - name: registry_cert_path
    description: 'Docker registry cert path'
    type: string
    value: '/etc/docker/certs.d'

  - name: registry_name
    description: 'directory contain certificate certain Docker registry. cis-docker-benchmark-3.7'
    type: string
    value: '/etc/docker/certs.d/registry_hostname:port'

  - name: registry_ca_file
    description: 'certificate file for a certain Docker registry certificate files. cis-docker-benchmark-3.7 and cis-docker-benchmark-3.8'
    type: string
    value: '/etc/docker/certs.d/registry_hostname:port/ca.crt'

  - name: container_user
    description: 'Docker container user'
    type: string
    value: 'vagrant'

  - name: authorization_plugin
    description: 'authorization plugin'
    type: string
    value: 'authz-broker'

  - name: log_driver
    description: 'log driver'
    type: string
    value: 'syslog'

  - name: log_opts
    description: 'log opts'
    type: string
    value: '/syslog-address/'

  - name: app_armor_profile
    description: 'app armor profile'
    type: string
    value: 'docker-default'

  - name: selinux_profile
    description: 'selinux profile'
    type: string
    value: '/label\:level\:s0-s0\:c1023/'

  - name: daemon_tlscacert
    description: 'Trust certs signed only by this CA'
    type: string
    value: '/etc/docker/ssl/ca.pem'

  - name: daemon_tlscert
    description: 'Path to TLS certificate file'
    type: string
    value: '/etc/docker/ssl/server_cert.pem'

  - name: daemon_tlskey
    description: 'Path to TLS key file'
    type: string
    value: '/etc/docker/ssl/server_key.pem'

  - name: allowed_ports
    description: 'The list of allowed docker container ports'
    type: array
    value: []

  - name: swarm_mode
    description: 'define the swarm mode, `active` or `inactive`'
    type: string
    value: 'inactive'

  - name: swarm_max_manager_nodes
    description: 'number of manager nodes in a swarm'
    type: numeric
    value: 3

  - name: swarm_port
    description: 'port of the swarm node'
    type: numeric
    value: 2377

  - name: container_capadd
    description: 'Docker container cap add'
    type: numeric
    value: 10