---
title: "HOST-CTR-006 Docker Userland Proxy Enabled"
canonical: https://openvapt.com/checks/HOST-CTR-006.html
html: https://openvapt.com/checks/HOST-CTR-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-CTR-006 Docker Userland Proxy Enabled

Checks whether the Docker daemon still uses the docker-proxy userland process for published ports.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-1188
- NIST SP 800-53 Rev. 5: CM-7, CM-6
- Benchmark topic: CIS Docker Benchmark 2.14 (disable the userland proxy) (topic only, no benchmark text)

## Why It Matters

The userland proxy is a root process per published port that exists only for an old loopback edge case. Hairpin NAT does the same job in the kernel with less code running as root and fewer processes to crash or exploit.

## How It Detects

Reads /etc/docker/daemon.json and fails unless userland-proxy is false.

## How to Fix

Add  "userland-proxy": false  to /etc/docker/daemon.json and restart Docker; test that published ports still answer from the host itself.

## How to Verify

```
ps -C docker-proxy  should list nothing after containers are recreated.
```

## Learn the Theory

- [P9 Containers and Kubernetes](https://openvapt.com/academy/p9.md)
- [A5 Container Runtime Hardening Depth](https://openvapt.com/academy/a5.md)

## References

- [Docker documentation, dockerd daemon reference](https://docs.docker.com/reference/cli/dockerd/)
- [CIS Docker Benchmark (referenced by recommendation number)](https://www.cisecurity.org/benchmark/docker)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go

Run it: `openvapt scan --only HOST-CTR-006`. Read it offline: `openvapt explain HOST-CTR-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-CTR-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.