mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-18 16:22:33 +01:00
Add test for OOM killer disable
It is the best practise that only disable the OOM killer on containers where you have also set the `-m/--memory` option. If the `-m/--memeory` flag is not set, this can result in the host running out of memory and require killing the host's system processes to free memory. Examples: The following example limits the memory to 100M and disables the OOM killer for this container: $ docker run -ti -m 100M --oom-kill-disable ubuntu:14.04 /bin/bash The following example, illustrates a dangerous way to use the flag: $ docker run -ti --oom-kill-disable ubuntu:14.04 /bin/bash The container has unlimited memory which can cause the host to run out memory and require killing system processes to free memory. Signed-off-by: Hu Keping <hukeping@huawei.com>
This commit is contained in:
parent
322124c1dc
commit
100b63dac5
1 changed files with 25 additions and 0 deletions
|
@ -466,4 +466,29 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_19"
|
||||
fi
|
||||
|
||||
# 5.20
|
||||
check_5_20="5.20 - Only disable the OOM Killer on containers where you have also set the '-m/--memory' option"
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
oom=$(docker inspect --format 'OomKillDisable={{ .HostConfig.OomKillDisable}}' "$c")
|
||||
mem=$(docker inspect --format 'Memory={{ .HostConfig.Memory}}' "$c")
|
||||
|
||||
if [ "$oom" = "OomKillDisable=true" -a "$mem" = "Memory=0" ]; then
|
||||
# If it's the first container, fail the test
|
||||
if [ $fail -eq 0 ]; then
|
||||
warn "$check_5_20"
|
||||
warn " * OOM Killer has been disabled without setting the memory: $c"
|
||||
fail=1
|
||||
else
|
||||
warn " * OOM Killer has been disabled without setting the memory: $c"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
# We went through all the containers and found none with OOM killer has been disabled but not setting the memory limit.
|
||||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_20"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
|
Loading…
Reference in a new issue