Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95609	DKER-EE-001770	SV-104747r1_rule		Low

Description
All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.

Description

All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.

STIG	Date
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide	2019-09-13

Details

Check Text ( C-94437r1_chk )
For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc. Execute the following command to validate the Docker image signature digests of UCP and DTR: docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version] Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.

Check Text ( C-94437r1_chk )

For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc.

Execute the following command to validate the Docker image signature digests of UCP and DTR:

docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version]

Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.

Fix Text (F-101275r1_fix)
For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc. When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows: docker.io/docker/ucp:[ucp_version] docker.io/docker/dtr:[dtr_version] If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows: https://docs.docker.com/ee/ucp/admin/install/install-offline/ https://docs.docker.com/ee/dtr/admin/install/install-offline/

Fix Text (F-101275r1_fix)

For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc.

When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows:

docker.io/docker/ucp:[ucp_version]
docker.io/docker/dtr:[dtr_version]

If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows:

https://docs.docker.com/ee/ucp/admin/install/install-offline/
https://docs.docker.com/ee/dtr/admin/install/install-offline/