mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-18 16:22:33 +01:00
checking for the MaxAttempts=5 too at service level
This commit is contained in:
parent
16c235080d
commit
c8c90ee523
1 changed files with 12 additions and 2 deletions
|
@ -595,9 +595,19 @@ check_5_14() {
|
||||||
fail=0
|
fail=0
|
||||||
maxretry_unset_containers=""
|
maxretry_unset_containers=""
|
||||||
for c in $containers; do
|
for c in $containers; do
|
||||||
policy=$(docker inspect --format MaximumRetryCount='{{ .HostConfig.RestartPolicy.MaximumRetryCount }}' "$c")
|
for s in $(docker service ls --format '{{.Name}}'); do
|
||||||
|
if docker inspect "$c" --format '{{.Name}}' | grep -q "$s"; then
|
||||||
|
task_id=$(docker inspect "$c" --format '{{.Name}}' | awk -F '.' '{print $NF}')
|
||||||
|
# a container name could arbitrary include a service one: it belongs to a service (created by Docker
|
||||||
|
# as part of the service), if the container task ID matches one of the task IDs of the service.
|
||||||
|
if docker service ps --no-trunc "$s" --format '{{.ID}}' | grep -q "$task_id"; then
|
||||||
|
spolicy=$(docker inspect --format MaximumRetryCount='{{ .Spec.TaskTemplate.RestartPolicy.MaxAttempts }}' "$s")
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
cpolicy=$(docker inspect --format MaximumRetryCount='{{ .HostConfig.RestartPolicy.MaximumRetryCount }}' "$c")
|
||||||
|
|
||||||
if [ "$policy" != "MaximumRetryCount=5" ]; then
|
if [ "$cpolicy" != "MaximumRetryCount=5" ] || [ "$spolicy" != "MaxAttempts=5" ]; then
|
||||||
# If it's the first container, fail the test
|
# If it's the first container, fail the test
|
||||||
if [ $fail -eq 0 ]; then
|
if [ $fail -eq 0 ]; then
|
||||||
warn -s "$check"
|
warn -s "$check"
|
||||||
|
|
Loading…
Reference in a new issue