search

sig-bsi-grundschutz / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://www.open-scap.org/security-policies/scap-security-guide
Other
7 stars 0 forks source link

SYS.1.6.A23 #23

Open sluetze opened 10 months ago

sluetze commented 1 month ago

Containers SHOULD not be able to change their file system at runtime.

This requirement must be implemented organizationally.

Note: By default, Red Hat recommends building containers so that the runtime UID does not have write permissions in the container. If the file system is changed (e.g. for a file system-based cache), this change will be lost when you restart, as the unchangeable image will be loaded again.

File systems SHOULD not be mounted with write permissions.

By default, local file systems are not mounted in containers. Containers access PVs that are integrated via OpenShift. This fulfills the requirement. Alternatively, ephemeral volumes can be used as volatile storage.

The container's root file system can be restricted to ReadOnly via the SecurityContext. Verification of this configuration can be carried out using ACS.