Rules / GL031

GL031 DOCKER_TLS_CERTDIR set to empty string disables Docker daemon TLS

Severity: error
OWASP: CICD-SEC-7 – Insecure System Configuration

What glsec checks

glsec flags any variables: block — top-level or job-level — where DOCKER_TLS_CERTDIR is set to an empty string. This disables TLS between the Docker client and the docker:dind service, which then listens on unencrypted TCP port 2375. Any process on the same network segment — including other jobs on a shared runner — can issue arbitrary commands to the Docker daemon. GitLab's own documentation notes: "This is insecure and gives root access on the machine to everyone who has access to your network."

This pattern originates from the Testcontainers GitLab CI documentation and has been copied into many projects as a result.

Trigger example

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""   # disables TLS — Docker daemon is unauthenticated on the runner network

services:
  - docker:dind

Safe alternative

variables:
  DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_CERTDIR: "/certs"

services:
  - name: docker:dind
    variables:
      DOCKER_TLS_CERTDIR: "/certs"

References

• GitLab docs: Use Docker to build Docker images — TLS
• Testcontainers GitLab CI guide (source of widespread propagation)

Documentation for glsec 1.23.0. Source of this page · Rule implementation