Metadata

Id: dockercompose-privileged-containers-enabled

Platform: DockerCompose

Severity: High

Category: Resource Management

Learn More

• Provider Reference

Description

Running a container in privileged mode (privileged: true) grants it nearly all Linux kernel capabilities and unrestricted access to all host devices, effectively removing the isolation boundary between the container and the host. A compromised privileged container can trivially escape to the host, read or modify any file, and affect other workloads or the kernel itself. Services should not set privileged: true; use targeted cap_add entries or specific devices mappings instead.

Compliant Code Examples

services:
  false_value:
    image: alpine
    privileged: false
  omitted:
    image: alpine

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    privileged: true