mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-19 08:42:33 +01:00
Compare commits
No commits in common. "820abe98c3966449cab8d48adb0de569f650b7e6" and "ba0b402ea56aafbb9a56f09cc13ee629160c58b6" have entirely different histories.
820abe98c3
...
ba0b402ea5
1 changed files with 7 additions and 9 deletions
|
@ -620,26 +620,24 @@ check_5_15() {
|
||||||
# a container name could arbitrary include a service one: it belongs to a service (created by Docker
|
# a container name could arbitrary include a service one: it belongs to a service (created by Docker
|
||||||
# as part of the service), if the container task ID matches one of the task IDs of the service.
|
# as part of the service), if the container task ID matches one of the task IDs of the service.
|
||||||
if docker service ps --no-trunc "$s" --format '{{.ID}}' | grep -q "$task_id"; then
|
if docker service ps --no-trunc "$s" --format '{{.ID}}' | grep -q "$task_id"; then
|
||||||
restart_policy=$(docker inspect --format '{{ .Spec.TaskTemplate.RestartPolicy.MaxAttempts }}' "$s")
|
spolicy=$(docker inspect --format MaxAttempts='{{ .Spec.TaskTemplate.RestartPolicy.MaxAttempts }}' "$s")
|
||||||
break
|
break
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
if docker inspect --format '{{ .HostConfig.RestartPolicy.MaximumRetryCount }}' "$c" &>/dev/null; then
|
cpolicy=$(docker inspect --format MaximumRetryCount='{{ .HostConfig.RestartPolicy.MaximumRetryCount }}' "$c")
|
||||||
restart_policy=$(docker inspect --format '{{ .HostConfig.RestartPolicy.MaximumRetryCount }}' "$c")
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$restart_policy" -gt "5" ]; then
|
if [ "$cpolicy" != "MaximumRetryCount=5" ] && [ "$spolicy" != "MaxAttempts=5" ]; then
|
||||||
# If it's the first container, fail the test
|
# If it's the first container, fail the test
|
||||||
if [ $fail -eq 0 ]; then
|
if [ $fail -eq 0 ]; then
|
||||||
warn -s "$check"
|
warn -s "$check"
|
||||||
warn " * MaximumRetryCount is not set to 5 or less: $c"
|
warn " * MaximumRetryCount is not set to 5: $c"
|
||||||
maxretry_unset_containers="$maxretry_unset_containers $c"
|
maxretry_unset_containers="$maxretry_unset_containers $c"
|
||||||
fail=1
|
fail=1
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
warn " * MaximumRetryCount is not set to 5 or less: $c"
|
warn " * MaximumRetryCount is not set to 5: $c"
|
||||||
maxretry_unset_containers="$maxretry_unset_containers $c"
|
maxretry_unset_containers="$maxretry_unset_containers $c"
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
@ -649,7 +647,7 @@ check_5_15() {
|
||||||
logcheckresult "PASS"
|
logcheckresult "PASS"
|
||||||
return
|
return
|
||||||
fi
|
fi
|
||||||
logcheckresult "WARN" "Containers with MaximumRetryCount not set to 5 or less" "$maxretry_unset_containers"
|
logcheckresult "WARN" "Containers with MaximumRetryCount not set to 5" "$maxretry_unset_containers"
|
||||||
}
|
}
|
||||||
|
|
||||||
check_5_16() {
|
check_5_16() {
|
||||||
|
|
Loading…
Reference in a new issue