CIS Containerd Benchmark

This recommendation verifies that Containerd is running the latest stable version on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check containerd version
containerd --version
ctr version

# Update containerd
apt-get update && apt-get install -y containerd.io
systemctl restart containerd

This recommendation verifies that the configuration file is generated and customized on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check containerd configuration
containerd config dump | head -40
ls -la /etc/containerd/config.toml

# Generate and customize default config
containerd config default > /etc/containerd/config.toml
# Edit /etc/containerd/config.toml as needed
systemctl restart containerd

This recommendation verifies that systemd cgroup driver is configured on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check default runtime configuration
containerd config dump | grep -A5 'default_runtime'
containerd config dump | grep 'SystemdCgroup'

# Configure systemd cgroup driver
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
  SystemdCgroup = true
# Restart:
systemctl restart containerd

This recommendation verifies that default seccomp/AppArmor profiles are enabled on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AppArmor / seccomp profiles
ctr containers list | head -5
containerd config dump | grep -i 'seccomp\|apparmor'

# Enable default seccomp profile
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri"]
  enable_selinux = false
  sandbox_image = "registry.k8s.io/pause:3.9"
[plugins."io.containerd.grpc.v1.cri".containerd]
  default_runtime_name = "runc"
  # Seccomp enforced by Kubernetes PSS or pod spec

This recommendation verifies that TLS is configured for private registries on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS for private registries
containerd config dump | grep -A10 'registry.mirrors'

# Configure TLS for registry
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri".registry.configs."registry.example.com".tls]
  ca_file   = "/etc/containerd/certs.d/ca.pem"
  cert_file = "/etc/containerd/certs.d/client.pem"
  key_file  = "/etc/containerd/certs.d/client-key.pem"
systemctl restart containerd

This setting ensures that gRPC socket permissions are restricted on the Containerd container runtime. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Containerd container runtime is essential for defense in depth.

# Check gRPC socket permissions
stat -c '%a %U %G' /run/containerd/containerd.sock
ls -la /run/containerd/

# Restrict gRPC socket access
chmod 660 /run/containerd/containerd.sock
chown root:containerd /run/containerd/containerd.sock
# Add authorized users to containerd group only

This recommendation verifies that containerd service logging is configured on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check containerd logging
journalctl -u containerd --no-pager | tail -20
containerd config dump | grep 'level'

# Configure logging level
# In /etc/containerd/config.toml (root level):
# [debug]
#   level = "info"
# Forward containerd logs:
cat > /etc/rsyslog.d/containerd.conf << 'EOF'
if $programname == 'containerd' then /var/log/containerd.log
& stop
EOF
systemctl restart rsyslog

This recommendation verifies that container log limits and rotation are configured on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check container log configuration
containerd config dump | grep -i 'max_container_log'

# Configure container log limits
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri"]
  max_container_log_line_size = 16384
# Configure logrotate for containerd:
cat > /etc/logrotate.d/containerd << 'EOF'
/var/log/containerd.log {
    daily
    rotate 30
    compress
    missingok
    notifempty
}
EOF

This recommendation verifies that containerd namespaces are used for isolation on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check namespace isolation
ctr namespaces list
ctr -n k8s.io containers list | head -5

# Use separate namespaces
# Containerd namespaces isolate workloads:
ctr namespaces create prod
ctr namespaces create dev
# Avoid running user workloads in default namespace
# Kubernetes uses k8s.io namespace automatically

This recommendation verifies that overlay snapshotter is configured on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check storage driver & snapshotter
containerd config dump | grep snapshotter

# Configure overlay snapshotter
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri".containerd]
  snapshotter = "overlayfs"
# Verify kernel module:
modprobe overlay
lsmod | grep overlay

This setting ensures that data directory permissions are restricted on the Containerd container runtime. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Containerd container runtime is essential for defense in depth.

# Check data directory permissions
stat -c '%a %U %G' /var/lib/containerd
find /var/lib/containerd -maxdepth 1 -type d -exec stat -c '%a %n' {} \;

# Restrict data directory
chown root:root /var/lib/containerd
chmod 710 /var/lib/containerd
chmod 700 /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs

This setting ensures that configuration file permissions are restricted on the Containerd container runtime. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Containerd container runtime is essential for defense in depth.

# Check config file permissions
stat -c '%a %U %G' /etc/containerd/config.toml
find /etc/containerd -type f -exec stat -c '%a %n' {} \;

# Restrict configuration files
chown root:root /etc/containerd/config.toml
chmod 600 /etc/containerd/config.toml
chmod 700 /etc/containerd

This setting ensures that image sources are restricted to trusted registries on the Containerd container runtime. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Containerd container runtime is essential for defense in depth.

# Check image pull settings
containerd config dump | grep -A5 'registry'

# Restrict image sources
# In /etc/containerd/config.toml:
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
  endpoint = ["https://registry.example.com"]
# Use allowlisted registries only
# Enable image verification with cosign/notation

This recommendation verifies that resource limits are configured for the containerd service on the Containerd container runtime. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Containerd container runtime vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check resource limits for containerd
systemctl show containerd | grep -i limit
cat /etc/systemd/system/containerd.service.d/override.conf 2>/dev/null

# Configure resource limits
mkdir -p /etc/systemd/system/containerd.service.d
cat > /etc/systemd/system/containerd.service.d/override.conf << 'EOF'
[Service]
LimitNOFILE=1048576
LimitNPROC=infinity
LimitCORE=infinity
OOMScoreAdjust=-999
EOF
systemctl daemon-reload
systemctl restart containerd