Privileged host ports published

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-privileged-ports-mapped-in-container

Platform: DockerCompose

Severity: Low

Category: Networking and Firewall

Learn More

Description

Publishing container services on privileged host ports (1–1023) requires elevated privileges on the host OS and may conflict with well-known system services, increasing the risk of port conflicts and unintended service exposure. Services should map to unprivileged host ports (1024 and above) wherever possible. Port mappings where the host port falls within the 1–1023 range will be flagged.

Compliant Code Examples

services:
  target_only:
    image: alpine
    ports: ['80']
  unprivileged_host:
    image: alpine
    ports: ['8080:80']
  unprivileged_host_range:
    image: alpine
    ports: ['2000-2100:80-180']
  privileged_target_only:
    image: alpine
    ports:
      - target: 80
        published: 8080

Non-Compliant Code Examples

services:
  privileged_scalar:
    image: alpine
    ports: ['80:8080']
    cap_drop: [NET_BIND_SERVICE]
  overlapping_privileged_range:
    image: alpine
    ports: ['1000-1100:2000-2100/udp']
  privileged_ipv6_long:
    image: alpine
    ports:
      - target: 8080
        published: '443'
        host_ip: '::1'
        protocol: tcp