> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide.md).

# Docker hardening Guide

Configure Docker hardening in Cortex XSOAR 6.15 using non-root users, resource limits, and network access controls.

Use these recommended Cortex XSOAR settings to harden Docker containers on Ubuntu. Configure non-root users, container resource limits, and IP access restrictions using `iptables`.

You can also apply these settings to [Podman](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman.md), except memory, CPU, and PID limits. Review [Docker network hardening](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md) for network security controls.

{% hint style="info" %}
Docker hardening must be configured and is not applied by default at installation.
{% endhint %}

### Use the latest Docker version

To securely run Docker containers, we recommend you use the latest Docker version.

### Run Docker with a non-root internal user

Running Docker containers with non-root internal users provides added security isolation and follows the principle of least privilege. For more information, see [Run Docker with Non-Root Internal Users](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md).

### Limit Docker container resources

To protect the host from a container using too many system resources (either because of a software bug or a DoS attack), limit the resources available for each container. In Cortex XSOAR, some of these settings are set using the advanced parameter:

`python.pass.extra.keys`.

This key receives as a parameter full `docker run` options, separated with the `##` string.

#### Limit Docker container memory

We recommend limiting available memory for each container to 1 GB.

{% hint style="info" %}

### Note

On RHEL distributions with Docker CE or EE with version 17.06 and later, ensure that your kernel fully supports `kmem` accounting or that it has been compiled to disable `kmem` accounting. The `kmem` accounting feature in Red Hat’s Linux kernel has been reported to contain bugs, which cause kernel deadlock or slow kernel memory leaks. This is caused by a patch introduced in runc, which turns on `kmem` accounting automatically when user memory limitation is configured, even if not requested by the Docker CLI setting `--kernel-memory` (see [opencontainers/runc#1350](https://github.com/opencontainers/runc/pull/1350)). Using Red Hat's distribution of Docker based on version 1.13.1 users are not affected as this distribution of Docker does not include the `runc` patch. For more information, see [Red Hat’s Docker distribution documentation](https://access.redhat.com/articles/2317361).

If you do not want to apply Docker memory limitations, you should explicitly set the advanced parameter: **`limit.docker.memory`** to **`false`**.
{% endhint %}

#### Configure swap limit support

Not all Linux distributions have the swap limit support enabled by default.

* Red Hat distributions usually have swap limit support enabled by default.
* Ubuntu distributions usually have swap limit support disabled by default.

To check if your system supports swap limit capabilities, after logging into the Server machine console (ssh), run the following command:

`sudo docker run --rm -it --memory=1g demisto/python:1.3-alpine true` command.

If you see **`WARNING: Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.`** in the output (the message may vary between Docker versions), you have two options:

* Configure **`swap limit capabilities`** by following the [Docker documentation](https://docs.docker.com/install/linux/linux-postinstall/#your-kernel-does-not-support-cgroup-swap-limit-capabilities).
* [Configure Memory Limit Support Without Swap Limit Capabilities](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-memory-limit-support-without-swap-limit-capabilities.md).

If **`swap limit capabilities`** is enabled, [Configure the Memory Limitation](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-memory-limitation.md).

To test the memory, see [Test the Memory Limit](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/test-the-memory-limit.md).

#### Limit Docker container CPU

We recommend limiting each container to 1 CPU. See [Limit Available CPU](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/limit-available-cpu.md).

#### Limit Docker container PIDs

We recommend limiting each container to 256 PIDs. This value is sufficient for using threads and sub-processes, and protects against a fork bomb. You need to [configure the PIDs limit](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-pids-limit.md) by setting the `python.pass.extra.keys` advanced parameter. If you have this key already set up with a value, append to it the config after a ## separator.

#### Limit Docker container file descriptors

We recommend using a soft/hard limit of 1024/8192 file descriptors for each container process. You need to [Configure the Open File Descriptors Limit](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-open-file-descriptors-limit.md). If you have this key already set up with a value, append to it the config after a ## separator.

### Verify Docker hardening configuration

To test that the hardening configuration has been applied correctly, use the **`DockerHardeningCheck`** automation.

{% hint style="info" %}

### Note

The **`DockerHardeningCheck`** automation does not work with Podman.
{% endhint %}

### Configure Docker hardening on engines

For each engine to which you want to apply Docker hardening, you need to [edit the engine’s configuration](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines.md) to include the Docker hardening advanced parameters. For example, you would add the following snippet to the configuration JSON file:

`{"docker.run.internal.asuser": true,"limit.docker.cpu": true,"limit.docker.memory": true,"python.pass.extra.keys": "--pids-limit=256##--ulimit=nofile=1024:8192"}`

You can [run scripts on an engine](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/run-a-script-using-an-engine.md). To verify the Docker container has been hardened according to recommended settings, run the **`DockerHardeningCheck`** automation on the engine.

### Docker image-specific settings

You can apply more specific fine-tuned settings to Docker images, according to the Docker image name or the Docker image name including the image tag. To apply settings to a Docker image name, use the advanced server configuration `python.pass.extra.keys.`*`<image_name>`*. For example, `python.pass.extra.keys.demisto/dl`.

To apply settings to a Docker image name including the image tag, use `python.pass.extra.keys.`*`<image_name>`*`:`*`<image_tag>`*. For example, `python.pass.extra.keys.demisto/dl:1.4`.

For example, to set the Docker images `demisto/dl (all tags)` to use a higher max memory value of 2GB and to remain with the recommended PIDs and ulimit, use the following:

| Key                                 | Value                                                      |
| ----------------------------------- | ---------------------------------------------------------- |
| `python.pass.extra.keys.demisto/dl` | `--memory=2g##--ulimit=nofile=1024:8192##--pids-limit=256` |

If you apply Docker image-specific settings, they will be used instead of the general python.pass.extra.keys setting. This will also override the general memory and CPU settings as needed.

{% hint style="info" %}

### Note

To apply these settings to engines, edit each engine’s configuration file to include the advanced parameters.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.