Enable the Docker service

An XCCDF Rule

Description

The docker service is commonly needed to create containers. The docker service can be enabled with the following command:

$ sudo systemctl enable docker.service

Rationale

To be able to find any problems with misconfiguration of the docker daemon and running containers, the docker service has to be enabled.

ID: xccdf_org.ssgproject.content_rule_service_docker_enabled
Severity: Medium
References: CCE-80440-1
Updated: about 1 year ago


[customizations.services]
enabled = ["docker"]

- name: Enable service docker
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto
  - name: Enable service docker
    systemd:
      name: docker
      enabled: 'yes'
      state: started
      masked: 'no'
    when:
    - '"docker" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-80440-1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_docker_enabled

include enable_docker

class enable_docker {
  service {'docker':
    enable => true,
    ensure => 'running',  }
}

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'docker.service'
"$SYSTEMCTL_EXEC" start 'docker.service'"$SYSTEMCTL_EXEC" enable 'docker.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable the Docker service

Description

Rationale

Remediation - OS Build Blueprint

Remediation - Ansible

Remediation - Puppet

Remediation - Shell Script