---
title: Dangerous host device exposed to container
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > Dangerous host device exposed to container
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Dangerous host device exposed to container

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `dockercompose-dangerous-host-device-exposed` 

**Platform:** DockerCompose

**Severity:** High

**Category:** Resource Management

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.docker.com/reference/compose-file/services/#devices)

### Description{% #description %}

Exposing dangerous host devices such as physical or kernel memory, raw disks, loop and device-mapper volumes, or USB devices gives a container direct access to host hardware and persistent storage. An attacker with container access could overwrite host data or inspect kernel memory. Services should not include these devices or their descendants in `devices`.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
services:
  sound:
    image: alpine
    devices:
      - /dev/snd:/dev/snd
  gpu:
    image: alpine
    devices:
      - /dev/dri/card0:/dev/dri/card0
  nested_virtualization:
    image: alpine
    devices:
      - /dev/kvm:/dev/kvm
  object_sound:
    image: alpine
    devices:
      - source: /dev/snd
        target: /dev/snd
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
services:
  mem_access:
    image: alpine
    devices:
      - /dev/mem:/dev/mem
  disk_access:
    image: alpine
    devices:
      - /dev/sda:/dev/sda
  usb_access:
    image: alpine
    devices:
      - /dev/bus/usb/001/002:/dev/usb
  loop_access:
    image: alpine
    devices:
      - /dev/loop0:/dev/loop0
  mapper_access:
    image: alpine
    devices:
      - /dev/mapper/cryptroot:/dev/mapper/cryptroot
  device_mapper_access:
    image: alpine
    devices:
      - /dev/dm-0:/dev/dm-0
  raid_access:
    image: alpine
    devices:
      - /dev/md0:/dev/md0
  object_memory_access:
    image: alpine
    devices:
      - source: /dev/kmem
        target: /dev/kmem
  disk_alias:
    image: alpine
    devices:
      - /dev/disk/by-id/nvme-eui.123:/dev/sda
  block_alias:
    image: alpine
    devices:
      - /dev/block/8:0:/dev/sda
  rbd_access:
    image: alpine
    devices:
      - /dev/rbd0:/dev/rbd0
  nbd_access:
    image: alpine
    devices:
      - /dev/nbd0:/dev/nbd0
  zvol_access:
    image: alpine
    devices:
      - /dev/zvol/tank/vol:/dev/zvol/tank/vol
```