Your utility doesn't correctly recognize the CPU limit (NanoCpus)

[melroy89]

Hallå,

I set resources CPU and memory limits using Docker compose (v3) under Linux:

deploy:
  resources:
    limits:
      cpus: '1.5'
      memory: 400M

Docker bench security however still gives me the following errors for this Docker container:

Container running without CPU restrictions: <container>

The docker inspect <container> command also correctly displays the limit meaning my settings are correctly applied to this Docker container, like so:

{
     "Id": "....",
     "HostConfig": {
          "Memory": 419430400,
          "NanoCpus": 1500000000,
     }
}

Meaning that your Docker Bench Security still report issues on the CPU limit, while there are actually solved!

How is that possible?

[melroy89]

I see the same issue with:

Container no default ulimit override: <another_container>

And I actually did set a ulimit for this other container using Docker Compose v3 under Linux once again:

ulimits:
  nofile:
    soft: 65535
    hard: 500000

Docker inspect does confirm my settings once again:

"HostConfig": {
      "Ulimits": [
          {
              "Name": "nofile",
              "Hard": 500000,
              "Soft": 65535
          }
      ],
}

I do NOT use Docker swarm of Docker. So maybe it's good to say that I use the docker compose --compatibility feature flag. But it doesn't make my reported issue invalid.

[konstruktoid]

Thanks for reporting this @Danger89, I'll have a look.
Are you running the shell script directly or in a container?

[konstruktoid]

Can't reproduce using a standard, non-Swarm, configuration.

# docker-compose.yml file
version: '3'

services:
  nginx:
    image: nginx:1.16.0-alpine
    ports:
      - "8080:80"
    ulimits:
      nofile:
        soft: 65535
        hard: 500000
    mem_limit: 100M
    cpu_shares: 10

$ docker ps
CONTAINER ID   IMAGE                 COMMAND                  CREATED         STATUS         PORTS                                   NAMES
a97a1f78afed   nginx:1.16.0-alpine   "nginx -g 'daemon of…"   3 minutes ago   Up 3 minutes   0.0.0.0:8080->80/tcp, :::8080->80/tcp   vagrant-nginx-1
$ docker inspect --format 'Ulimits={{ .HostConfig.Ulimits }}, CPUShares={{ .HostConfig.CpuShares }}, Memory={{ .HostConfig.Memory }}' a97
Ulimits=[map[Hard:500000 Name:nofile Soft:65535]], CPUShares=10, Memory=104857600

$ sudo bash ./docker-bench-security.sh -c check_5_9,check_5_10,check_5_11,check_5_12,check_5_17,check_5_18,check_5_19
# --------------------------------------------------------------------------------------------
# Docker Bench for Security v1.3.6
#
# Docker, Inc. (c) 2015-2023
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Based on the CIS Docker Benchmark 1.4.0.
# --------------------------------------------------------------------------------------------

Initializing 2023-02-02T10:20:06+00:00


Section A - Check results
[PASS] 5.9 - Ensure that the host's network namespace is not shared (Automated)
[PASS] 5.10 - Ensure that the memory usage for containers is limited (Automated)
[PASS] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated)
[WARN] 5.12 - Ensure that the container's root filesystem is mounted as read only (Automated)
[WARN]       * Container running with root FS mounted R/W: vagrant-nginx-1
[PASS] 5.17 - Ensure that host devices are not directly exposed to containers (Manual)
[PASS] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed (Manual)
[PASS] 5.19 - Ensure mount propagation mode is not set to shared (Automated)


Section C - Score

[INFO] Checks: 7
[INFO] Score: 3

[konstruktoid]

Please test #511

[melroy89]

Thanks for reporting this @Danger89, I'll have a look. Are you running the shell script directly or in a container?

I run the shell script directly on the host.

[melroy89]

Sorry, I have many Docker containers running. I got a bit confused.

The memory check and ulimit check are indeed fine! Eg.

docker inspect --format '{{ .HostConfig.Ulimits }}' "<container>"
[nofile=65535:500000]

I think your PR will fix the CPU limit check in my case, which is indeed gets translated into NanoCpus.