Bidirectional bind propagation

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-bidirectional-bind-propagation

Platform: DockerCompose

Severity: High

Category: Access Control

Learn More

Description

Bidirectional bind mount propagation modes (shared, rshared) allow mount and unmount events in a container’s bind mount to propagate back to the host or to other containers, enabling unintended cross-container data sharing and potential information disclosure. Bind mounts in the volumes list should use private, rprivate, slave, or rslave propagation to prevent container events from reaching the host. Volume entries specifying shared or rshared in the mount options will be flagged.

Compliant Code Examples

services:
  private_bind:
    image: alpine
    volumes:
      - type: bind
        source: /srv/data
        target: /data
        bind:
          propagation: private
  named_lookalike:
    image: alpine
    volumes: ['data:/data:shared']
  one_way_propagation:
    image: alpine
    volumes:
      - /srv/cache:/cache:rslave
      - type: bind
        source: /srv/logs
        target: /logs
        bind:
          propagation: slave
volumes:
  data: {}

Non-Compliant Code Examples

services:
  long_shared:
    image: alpine
    volumes:
      - type: bind
        source: /srv/data
        target: /data
        bind:
          propagation: rshared
  named_shared:
    image: alpine
    volumes: ['hostproc:/data:rshared']
  relative_dot_shared:
    image: alpine
    volumes: ['.:/data:rshared']
  named_rbind_shared:
    image: alpine
    volumes: ['hostetc:/data:rshared']
  named_driver_opts_shared:
    image: alpine
    volumes: ['hostvar:/data']
volumes:
  hostproc:
    driver_opts:
      type: none
      o: bind
      device: /proc
  hostetc:
    driver_opts:
      type: none
      o: rbind
      device: /etc
  hostvar:
    driver_opts:
      type: none
      o: bind,rshared
      device: /var/run