---
title: Privileged host ports published
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > Privileged host ports published
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Privileged host ports published

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `dockercompose-privileged-ports-mapped-in-container` 

**Platform:** DockerCompose

**Severity:** Low

**Category:** Networking and Firewall

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.docker.com/reference/compose-file/services/#ports)

### Description{% #description %}

Publishing container services on host ports in the well-known range (1–1023) can conflict with host system services. Review the selected host port and whether external access is intended. To restrict access to local clients, bind the service to `127.0.0.1` or `::1`.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
services:
  target_only:
    image: alpine
    ports: ['80']
  unprivileged_host:
    image: alpine
    ports: ['8080:80']
  unprivileged_host_range:
    image: alpine
    ports: ['2000-2100:80-180']
  privileged_target_only:
    image: alpine
    ports:
      - target: 80
        published: 8080
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
services:
  privileged_scalar:
    image: alpine
    ports: ['80:8080']
    cap_drop: [NET_BIND_SERVICE]
  overlapping_privileged_range:
    image: alpine
    ports: ['1000-1100:2000-2100/udp']
  privileged_ipv6_long:
    image: alpine
    ports:
      - target: 8080
        published: '443'
        host_ip: '::'
        protocol: tcp
```