> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md).

# Docker FAQs

<details>

<summary>Does Cortex XSOAR use COPY or ADD for building images?</summary>

Cortex XSOAR uses COPY for building images. The COPY instruction copies files from the local host machine to the container file system. Cortex XSOAR does not use the ADD instruction, which could potentially retrieve files from remote URLs and perform operations such as unpacking, introducing potential security vulnerabilities.

</details>

<details>

<summary>Should the <code>--restart</code> flag be used?</summary>

The `--restart` flag should not be used. Cortex XSOAR manages the lifecycle of Docker images and restarts images as needed.

</details>

<details>

<summary>Can we restrict containers from acquiring additional privileges by setting the no-new-privileges option?</summary>

Cortex XSOAR does not support the no-new-privileges option. Some integrations and scripts may need to change privileges when running as a non-root user, such as Ping.

</details>

<details>

<summary>Can we apply a daemon-wide custom seccomp profile?</summary>

The [default seccomp profile](https://docs.docker.com/engine/security/seccomp/) from Docker is strongly recommended. The default seccomp profile provides protection and wide application compatibility. While you can apply a custom seccomp profile, Cortex XSOAR cannot guarantee that it won't block system calls used by an integration or script. If you apply a custom seccomp profile, verify and test it with any integrations or scripts you plan to use.

</details>

<details>

<summary>Can we use TLS authentication for Docker daemon configuration?</summary>

TLS authentication is not used, because Cortex XSOAR does not use Docker remote connections. All communication is done via the local Docker IPC socket.

</details>

<details>

<summary>How do we set the logging level to <code>info</code>?</summary>

Set the log level in the [Docker daemon configuration file](https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file).

</details>

<details>

<summary>Can we restrict Linux kernel capabilities within containers?</summary>

The default Docker settings include 14 kernel capabilities and exclude 23. Refer to Docker’s [full list of runtime privileges and Linux capabilities](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities).

You can further exclude capabilities through advanced configuration. First verify that no script requires the capability. For example, Ping requires the `NET_RAW` capability.

</details>

<details>

<summary>Is the Docker health check option implemented at runtime?</summary>

The Cortex XSOAR tenant monitors container health and restarts or terminates containers as needed. The Docker health check option is not needed.

</details>

<details>

<summary>Can we enable live restore?</summary>

Live restore is not used. Cortex XSOAR uses ephemeral Docker containers. Every running container is stateless by design.

</details>

<details>

<summary>Can we restrict network traffic between containers?</summary>

Cortex XSOAR does not disable inter-container communication by default. Some use cases require it. For example, a script communicating with a long-running integration that listens on a port may require inter-container communication. If it is not required, disable it by modifying the [Docker daemon configuration](https://docs.docker.com/engine/reference/commandline/dockerd/).

</details>

<details>

<summary>Can we enable user namespace remapping?</summary>

Cortex XSOAR does not support user namespace remapping.

</details>

<details>

<summary>How do we configure auditing for Docker files and directories?</summary>

Auditing is an operating system configuration. Enable it in the operating system settings. Cortex XSOAR does not change operating system audit settings.

</details>

<details>

<summary>Does Cortex XSOAR map privileged ports?</summary>

Cortex XSOAR does not map privileged ports, which are TCP/IP port numbers below 1024.

</details>

<details>

<summary>Does Cortex XSOAR allow privileged execution?</summary>

Cortex XSOAR does not allow privileged execution of Docker commands.

</details>

<details>

<summary>Does Cortex XSOAR run SSH within containers?</summary>

Cortex XSOAR does not run SSH within containers.

</details>

<details>

<summary>Does Cortex XSOAR change the ownership of the socket?</summary>

Cortex XSOAR does not change the ownership of the socket.

</details>

<details>

<summary>Can we disable the userland proxy?</summary>

If the kernel supports hairpin NAT, you can disable Docker userland proxy settings by modifying the [Docker daemon configuration](https://docs.docker.com/engine/reference/commandline/dockerd/).

</details>

<details>

<summary>Does Cortex XSOAR support the AppArmor profile?</summary>

Cortex XSOAR supports the default AppArmor profile. This is relevant only for Ubuntu with AppArmor enabled.

</details>

<details>

<summary>Does Cortex XSOAR support the SELinux profile?</summary>

Cortex XSOAR supports the default SELinux profile. This is relevant only for Red Hat with SELinux enabled.

</details>

<details>

<summary>How does Cortex XSOAR handle secrets management?</summary>

For Docker swarm services, a secret is a blob of data. It can include passwords, SSH private keys, or SSL certificates. It should not be transmitted over a network or stored unencrypted in a Docker file or application source code. Cortex XSOAR manages integration credentials internally. It also supports an [external credentials service](/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/manage-credentials.md), such as CyberArk.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.