Control: 2.5 Ensure insecure registries are not used
Description
Docker considers a private registry either secure or insecure. By default, registries are considered secure.
A secure registry uses TLS. A copy of registry's CA certificate is placed on the Docker host at /etc/docker/certs.d/<registry-name>/
directory. An insecure registry is one which does not have a valid registry certificate, or one not using TLS. Insecure registries should not be used as they present a risk of traffic interception and modification.
Additionally, once a registry has been marked as insecure commands such as docker pull, docker push, and docker search will not result in an error message and users may indefinitely be working with this type of insecure registry without ever being notified of the risk of potential compromise.
Remediation
You should ensure that no insecure registries are in use.
Default Value
By default, Docker assumes all, but local, registries are secure.
Usage
Run the control in your terminal:
powerpipe control run docker_compliance.control.cis_v160_2_5
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run docker_compliance.control.cis_v160_2_5 --share
SQL
This control uses a named query:
docker_info_insecure_registries_unused