Solution

This fix only applies to the DTR component of Docker Enterprise.

Enable vulnerability scanning:

via UI:

As a Docker EE Admin, navigate to 'System' | 'Security' in the DTR management console. Click the 'Enable Scanning' slider to enable this capability. Sync (online) or upload (offline) the vulnerability database.

via CLI:

Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console:

AUTHTOKEN=$(curl -sk -u : 'https://[dtr_url]/auth/token' | jq -r .token)
curl -k -H 'Authorization: Bearer $AUTHTOKEN' -X POST -d '{'scanningEnabled':true}' -H 'Content-Type: application/json' 'https://[dtr_url]/api/v0/meta/settings'

If DTR is offline, upload the latest vulnerability database (retrievable via Docker Enterprise subscription):

AUTHTOKEN=$(curl -sk -u : 'https://[dtr_url]/auth/token' | jq -r .token)
UPDATE_FILE='[path_to_cve_database].tar'
curl -k -H 'Authorization: Bearer $AUTHTOKEN' -H 'Content-Type: multipart/form-data' -H 'Accept: application/json' -X PUT -F [email protected]${UPDATE_FILE} 'https://[dtr_url]/api/v0/imagescan/scan/update?online=false'

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Risk Assessment.This control applies to the following type of system Unix.

References

• 800-53|RA-5(5)
• CAT|II
• CCI|CCI-001067
• Rule-ID|SV-235840r627647_rule
• STIG-ID|DKER-EE-003840
• STIG-Legacy|SV-104851
• STIG-Legacy|V-95713
• Vuln-ID|V-235840

Source

• Tenable.com/audits