Metadata

Id: dockercompose-no-new-privileges-disabled

Platform: DockerCompose

Severity: Medium

Category: Least Privilege

Learn More

• Provider Reference

Description

Setting no-new-privileges:false explicitly allows container processes to gain privileges through setuid or setgid binaries and file capabilities. This weakens protection against privilege escalation after a process is compromised. Services should remove the explicit disable or set no-new-privileges:true in security_opt.

Compliant Code Examples

services:
  absent:
    image: alpine
  bare:
    image: alpine
    security_opt: [no-new-privileges]
  colon:
    image: alpine
    security_opt: [no-new-privileges:true]
  equal:
    image: alpine
    security_opt: [no-new-privileges=true]

Non-Compliant Code Examples

services:
  false_colon:
    image: alpine
    security_opt:
      - no-new-privileges:false
  false_equal:
    image: alpine
    security_opt: [no-new-privileges=false]