Issue 521 restart policy

[andreagalle]

This fix double check for both the:

• container MaximumRetryCount
• service MaxAttempts

properties to be equal to 5.

Thus, fixing the #521 issue. The fix has been succesfully tested.

[konstruktoid]

Thanks!
I'll have a look as soon as possible

[andreagalle]

Now it should work as expected. I tried it out with: ./docker-bench-security.sh -c check_5_14

[konstruktoid]

I believe you just removed the original basic functionality :)
Test without a swarm node as well.

[andreagalle]

I believe you just removed the original basic functionality :) Test without a swarm node as well.

You mean the plain check on Docker containers or rather the one on Docker services, without a swarm node?
Could you better detail which test do you expect to be failing? (to replicate it)

[konstruktoid]

The plain check on Docker containers, and the test should fail when the 'on-failure' container restart policy is not set to '5'.

[andreagalle]

Indeed it works.

I mean, starting from the following Dockerfile

FROM alpine:latest
CMD sh -c "ping localhost"

I built a Docker image on it

docker build . -t work-image:latest

and ran a couples tests with --restart=on-failure:4 set to 4:

docker run -d --name=my-work-test --restart=on-failure:4 work-image:latest
./docker-bench-security.sh -c check_5_14

resulting in the warning below, as expected

[WARN] 5.14 - Ensure that the 'on-failure' container restart policy is set to '5' (Automated)
[WARN]       * MaximumRetryCount is not set to 5: my-work-test

and with --restart=on-failure:5 set to 5, with no [WARN] here.

[andreagalle]

The only issue is that in both cases (MaximumRetryCount and MaxAttempts) the container/service parameter is not 5 the warning message is alway the same as above. Although this is a minor issue, would you like to diversify them?

[konstruktoid]

So sorry, I've must have misread the code.
Works great with and without swarm mode.

[konstruktoid]

The only issue is that in both cases (MaximumRetryCount and MaxAttempts) the container/service parameter is not 5 the warning message is alway the same as above. Although this is a minor issue, would you like to diversify them?

No need to diversify unless you want to, I believe the message is understandable