> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/technology-overviews/twistlock-rules-guide-docker.md). # Prisma Cloud rules guide for Docker This article provides a list of all rules and their intended behavior in Prisma Cloud Console UI. The purpose of this article is to help users better understand the intention of each rule in the Console and it’s corresponding effect on the host environment. ## Running Docker commands through Defender To access Docker daemon through Defender, you must explicitly specify Defender’s host and port. For example: ``` $ docker -H :9998 run alpine ``` It is possible to make the management traffic between the Docker client and the Docker daemon flow through Defender by default via two environment variables. Those can be configured on a remote machine that accesses Docker daemon on some host (such as dev laptop), or the host itself for users who do not have root privileges (which should be the majority of users). ``` $ export DOCKER_HOST=tcp://:9998 $ export DOCKER_TLS_VERIFY=1 ``` Once set, default calls to Docker flow through Defender (e.g., docker ps, docker run alpine). Throughout this guide however, in this guide, we have followed the default command without setting environment variables. ### Containers For more information about the Docker API for containers, see . #### container\_list - List containers Affects docker ps command on host which is used to list all running containers. Command: ``` docker -H 10.0.0.1:9998 --tlsverify ps ``` Response: ``` [Prisma Cloud] The command container_list denied for user admin by rule Deny ``` #### container\_create - Create a container Affects docker create command used to create a new container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify create morello/docker-whale ``` Response: ``` [Prisma Cloud] The command container_create denied for user admin by rule Deny ``` #### container\_inspect - Inspect a container Affects docker inspect command used for returning information about the container. Command: ``` docker -H 10.0.0.1 --tlsverify inspect ubuntu_bash2 ``` Response: ``` [Prisma Cloud] The command container_inspect denied for user admin by rule inspect ``` #### container\_top - List processes running inside a container Affects docker top command used to display the running processes of a container Command: ``` docker -H 10.0.0.1:9998 --tlsverify top ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_top denied for user admin by rule Deny ``` #### container\_logs - Get container logs Affects docker logs command used for returning logs from the container present at the time of execution. Command: ``` docker -H 10.0.0.1 --tlsverify logs ubuntu_bash2 ``` Response: ``` [Prisma Cloud] The command container_logs denied for user admin by rule logs ``` #### container\_changes - Inspect changes on a container’s filesystem Affect docker commit command and restricts any changes to the container. Command: ``` docker -H 10.0.0.1 --tlsverify commit --change "ENV DEBUG true" cc2d57988b aqsa/testimage:version3 ``` Response: ``` [Prisma Cloud] The command container_commit denied for user admin by rule commit ``` #### container\_export - Export a container Affects docker export command that exports a container’s filesystem as a tar archive Command: ``` docker -H 10.0.0.1:9998 --tlsverify export twistlock_console -o saved.tar ``` Response: ``` [Prisma Cloud] The command container_export denied for user admin by rule export ``` #### container\_stats - Get container stats based on resource usage Affects docker stats command on host which returns live data stream for running containers. Command: ``` docker -H 10.0.0.1 --tlsverify stats silly_stallman ``` Response: ``` [Prisma Cloud] The command container_stats denied for user admin by rule status ``` #### container\_resize - Resize a container Affects docker logs command used for returning logs from the container present at the time of execution. This related to the size of the window of how output is returned from the container. It is called TTY. Command: Response: #### container\_start - Start a container Affects docker start command used to start one or more stopped containers Command: ``` docker -H 10.0.0.1:9998 --tlsverify start ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_start denied for user admin by rule Deny all ``` #### container\_stop - Stop a container Affects docker stop command used to stop running container Command: ``` docker -H 10.0.0.1:9998 --tlsverify stop ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_stop denied for user admin by rule Deny ``` #### container\_restart - Restart a container Affects docker restart command on host, used to restart a container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify restart ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_restart denied for user admin by rule Deny ``` #### container\_kill - Kill a container Affects docker kill command used to kill a running container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify kill ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_kill denied for user admin by rule Deny ``` #### container\_rename - Rename a container Affects docker rename command on host that is used to rename a container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify rename ubuntu_bash unbuntu ``` Response: ``` [Prisma Cloud] The command container_rename denied for user admin by rule Deny Error: failed to rename container named ubuntu_bash ``` #### container\_pause - Pause a container Affects docker pause command on host which is used to pause all processes within one or more containers. Command: ``` docker -H 10.0.0.1 --tlsverify pause focused_cori ``` Response: ``` [Prisma Cloud] The command container_pause denied for user admin by rule Deny ``` #### container\_unpause - Unpause a container Affects docker unpause command on host which is used to un-suspend all processes in a container. Command: ``` docker -H 10.0.0.1 --tlsverify unpause silly_stallman ``` Response: ``` [Prisma Cloud] The command container_unpause denied for user admin by rule unpause ``` #### container\_attach - Attach to a container Affects docker attach command on host where defender is deployed. Command: ``` docker -H 10.0.0.1 --tlsverify attach mycontainer ``` Response: ``` [Prisma Cloud] The command container_attach denied for user admin by rule attach persistent connection closed ``` #### container\_attachws - Attach to a container (websocket) Affects docker attach command on host where defender is deployed. Attach to the container id via websocket. Implements websocket protocol handshake according to RFC 6455 Command: ``` docker -H 10.0.0.1 --tlsverify attach mycontainer ``` Response: ``` [Prisma Cloud] The command container_attach denied for user admin by rule attach persistent connection closed ``` #### container\_wait - Wait a container Affects docker wait command used to block until a container stops, then print its exit code. Command: ``` docker -H 10.0.0.1:9998 --tlsverify wait ubuntu_bash ``` Response: ``` [Prisma Cloud] The command container_wait denied for user admin by rule Deny ``` #### container\_delete - Remove a container Affects docker rm command used for deleting a container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify rm ``` Response: ``` [Prisma Cloud] The command container_delete denied for user admin by rule delete ``` #### container\_archive - Gets an archive of filesystem resource in a container Get a tar archive of a resource in the filesystem of container id. Affects docker cp command Command: ``` docker -H 10.0.0.1:9998 --tlsverify cp > latest.tar ``` Response: ``` [Prisma Cloud] The command container_copy denied for user admin by rule delete ``` #### container\_extract - Extract an archive of files or folders to a directory in a container Affects docker export command. Uploads a tar archive to be extracted to a path in the filesystem of container id Command: ``` docker -H 10.0.0.1:9998 --tlsverify cp > latest.tar ``` Response: ``` [Prisma Cloud] The command container_exec_start denied for user admin by rule exec ``` ### Images For more information about the Docker API for images, see . #### image\_list - List images Affects docker images command used to list all images Command: ``` docker -H 10.0.0.1:9998 --tlsverify images ``` Response: ``` [Prisma Cloud] The command image_list denied for user admin by rule Deny ``` #### image\_build - Build image from a Dockerfile Affects docker build command that is used to build an image from a Dockerfile. Command: ``` docker -H 172.18.0.1:9998 --tlsverify build -t aqsa/testimage:v2 . ``` Response: ``` [Prisma Cloud] The command image_build denied for user admin by rule Default - deny all ``` #### image\_create - Create an image Affects docker pull command which is used to pull an image Command: ``` docker -H 10.0.0.1:9998 --tlsverify pull ubuntu:latest ``` Response: ``` [Prisma Cloud] The command image_create denied for user admin by rule Deny ``` #### image\_inspect - Inspect an image Description Affects docker inspect command used for returning information about the container. Command: ``` docker -H 10.0.0.1:9998 --tlsverify inspect 28e7d49f8e6d ``` Response: ``` [Prisma Cloud] The command image_inspect denied for user admin by rule images ``` #### image\_history - Get the history of an image Affects docker history \ command. Command: ``` docker -H 172.18.0.1:9998 --tlsverify history twistlock ``` Response: ``` [Prisma Cloud] The command image_history denied for user admin by rule Default - deny all ``` #### image\_push - Push an image on the registry Affects command docker push for pushing an image to repository Command: ``` docker -H 10.0.0.1:9998 --tlsverify push ubuntu:latest ``` Response: ``` [Prisma Cloud] The command image_push denied for user admin by rule Deny ``` #### image\_tag - Tag an image into a repository Affects docker tag command used to tag an image in the repository Command: ``` docker -H 10.0.0.1:9998 --tlsverify tag ubuntu:latest aqsa:tag ``` Response: ``` [Prisma Cloud] The command image_tag denied for user admin by rule Deny ``` #### image\_delete - Remove an image Affects docker rmi command used to delete an image Command: ``` docker -H 10.0.0.1:9998 --tlsverify rmi aqsa/testimage:version3 ``` Response: ``` [Prisma Cloud] The command image_delete denied for user admin by rule Deny ``` #### images\_search - Search images Affects docker search command which gives a list of available images matching the search item. Command: ``` docker -H 10.0.0.1:9998 --tlsverify search twistlock ``` Response: ``` [Prisma Cloud] The command images_search denied for user admin by rule deny ``` ### MISC Misc other docker commands. #### docker\_check\_auth - Check auth configuration Validates credentials for a registry and get identity token, if available, for accessing the registry without password. Affects docker login on the host. Command: ``` docker -H 172.18.0.1:9998 --tlsverify login ``` Response: ``` [Prisma Cloud] The command docker_info denied for user admin by rule Default - deny all ``` #### docker\_info - Display system-wide information Affects docker info command used to display system-wide information Command: ``` docker -H 10.0.0.1:9998 --tlsverify info ``` Response: ``` [Prisma Cloud] The command docker_info denied for user admin by rule Deny ``` #### docker\_version - Show the docker version information Affects docker version command on host which is used to find docker version. Command: ``` docker -H 10.0.0.1 --tlsverify version ``` Response: ``` [Prisma Cloud] The command docker_version denied for user admin by rule version ``` #### docker\_ping - Ping the docker server The goal of this api is to ping the Docker server and make sure it is up and running. Command: It is intended to be called by an external monitoring system. It does not have a direct docker CLI command. #### container\_commit - Create a new image from a container’s changes Affects docker commit command used for committing container’s file changes etc into a new image. Command: ``` docker -H 10.0.0.1 --tlsverify commit --change "ENV DEBUG true" cc2d57988b aqsa/testimage:version3 ``` Response: ``` [Prisma Cloud] The command container_commit denied for user admin by rule commit ``` #### docker\_events - Monitor docker’s events Affects docker events command on host which is used to return real time events from the server. Command: ``` docker -H 10.0.0.1 --tlsverify events ``` Response: ``` [Prisma Cloud] The command docker_events denied for user admin by rule events ``` #### images\_archive - Get a tarball containing all images Affects docker save command to save images to a tar archive Command: ``` docker -H 172.17.0.1:9998 --tlsverify save $(docker images -q) -o home/aqsa/mydockersimages.tar ``` Response: ``` [Prisma Cloud] The command images_archive denied for user admin by rule Default - deny all ``` #### images\_load - Load a tarball with a set of images and tags into docker Affects docker load command to load an image from a tar archive or STDIN Command: ``` docker -H 172.17.0.1:9998 --tlsverify load -i /home/aqsa/twistlock_1_6_81.tar.gz ``` Response: \[Prisma Cloud] The command images\_load denied for user admin by rule Default - deny all #### container\_exec\_create - Exec Create Affects docker\_exec command to create any new container. Command: ``` docker -H 10.0.0.1 --tlsverify exec -d ubuntu_bash2 touch /tmp/execWorks ``` Response: ``` [Prisma Cloud] The command container_exec_start denied for user admin by rule exec ``` #### container\_exec\_start - Exec Start Affects docker exec command used for running a command in a running container. Command: ``` docker -H 10.0.0.1 --tlsverify exec -d ubuntu_bash2 touch /tmp/execWorks ``` Response: ``` [Prisma Cloud] The command container_exec_start denied for user admin by rule exec ``` #### container\_exec\_inspect - Exec Inspect Affects docker exec command used for running a command in a running container. Command: ``` docker -H 10.0.0.1 --tlsverify exec -d ubuntu_bash2 touch /tmp/execWorks ``` Response: ``` [Prisma Cloud] The command container_exec_start denied for user admin by rule exec ``` #### container\_archive\_head Command: ``` docker -H 10.0.0.1 --tlsverify unpause silly_stallman ``` Response: ``` [Prisma Cloud] The command container_unpause denied for user admin by rule unpause ``` #### container\_copyfiles Affects docker cp command used to copy files from and to containers and local file system on host. Command: ``` docker -H 10.0.0.1 --tlsverify cp file mycontainer:~ ``` Response: ``` [Prisma Cloud] The command container_copyfiles denied for user admin by rule unpause ``` ### Volumes For more information about the Docker API for volumes, see . #### volume\_list - List volumes Affects docker volume ls command to list all volumes Command: ``` docker -H 10.0.0.1:9998 --tlsverify volume ls ``` Response: ``` [Prisma Cloud] The command volume_list denied for user admin by rule Deny ``` #### volume\_create - Create a volume Affects docker volume create command to create a volume Command: ``` docker -H 10.0.0.1:9998 --tlsverify volume create ``` Response: ``` [Prisma Cloud] The command volume_create denied for user admin by rule Deny ``` #### volume\_inspect - Inspect a volume Affects docker volume inspect command to display detailed information on one or more volumes Command: ``` docker -H 10.0.0.1:9998 --tlsverify volume inspect f1c7 ``` Response: ``` [Prisma Cloud] The command volume_inspect denied for user admin by rule Deny ``` #### volume\_remove - Remove a volume Affects docker volume rm command to remove one or more volumes Command: ``` docker -H 10.0.0.1:9998 --tlsverify volume rm f671 ``` Response: ``` [Prisma Cloud] The command volume_remove denied for user admin by rule Deny ``` ### Networks For information about the Docker API for networks, see . #### network\_list - list networks Affects docker network ls to list networks Command: ``` docker -H 172.17.0.1:9998 --tlsverify network ls ``` Response: ``` [Prisma Cloud] The command network_list denied for user admin by rule Default - deny all ``` #### network\_inspect - Inspect network Affects docker network inspect to display detailed information on one or more networks Command: ``` docker -H 172.17.0.1:9998 --tlsverify network inspect 82b1c ``` Response: ``` [Prisma Cloud] The command network_inspect denied for user admin by rule Default - deny all ``` #### network\_create - Create a network Affects docker network create to create a network Command: ``` docker -H 172.17.0.1:9998 --tlsverify network create new-network ``` Response: ``` [Prisma Cloud] The command network_create denied for user admin by rule Default - deny all ``` #### network\_connect - Connect a container to a network Affects docker network connect to connect a container to a network Command: ``` docker -H 172.17.0.1:9998 --tlsverify network connect new-network container1 ``` Response: ``` [Prisma Cloud] The command network_connect denied for user admin by rule Default - deny all ``` #### network\_disconnect - Disconnect a container from a network Affects docker network disconnect to disconnect a container from a network Command: ``` docker -H 172.17.0.1:9998 --tlsverify network disconnect new-network container1 ``` Response: ``` [Prisma Cloud] The command network_disconnect denied for user admin by rule Default - deny all ``` #### network\_remove - Remove a network Affects docker network rm to remove one or more networks Command: ``` docker -H 172.17.0.1:9998 --tlsverify network rm new-network ``` Response: ``` [Prisma Cloud] The command network_remove denied for user admin by rule Default - deny all ``` ### Secrets Secrets are added in Prisma Cloud 2.0 in accordance with Docker Engine API v1.26. For more information about the Docker API for secrets, see . #### secret\_list - List secrets Affects docker secret ls command used to list secrets. Command: ``` docker -H 10.0.0.1:9998 --tlsverify secret ls ``` Response: ``` [Prisma Cloud] The command secret_ls denied for user admin by rule Default - deny all ``` #### secret\_create - Create secrets Affects docker secret create command used to create secrets. Command: ``` docker -H 10.0.0.1:9998 --tlsverify secret create my-secret ./aqsa.json ``` Response: ``` [Prisma Cloud] The command secret_create denied for user admin by rule Default - deny all ``` #### secret\_inspect - Inspect secrets Affects docker secret inspect command used to inspect secrets. Command: ``` docker -H 10.0.0.1:9998 --tlsverify secret inspect ``` Response: ``` [Prisma Cloud] The command secret_inspect denied for user admin by rule Default - deny all ``` #### secret\_remove - Delete secrets Affects docker secret rm command used to remove one or more secrets. Command: ``` docker -H 10.0.0.1:9998 --tlsverify secret rm aqsa.json ``` Response: ``` [Prisma Cloud] The command secret_rm denied for user admin by rule Default - deny all ``` #### secret\_update - Update a secret Affects POST /secrets/{id}/update command used to remove one or more secrets. Command: Response: --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/technology-overviews/twistlock-rules-guide-docker.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.