---
title: Privileged host ports published
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > Privileged host ports published
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Privileged host ports published

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `dockercompose-privileged-ports-mapped-in-container` 

**Platform:** DockerCompose

**Severity:** Low

**Category:** Networking and Firewall

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.docker.com/reference/compose-file/services/#ports)

### Description{% #description %}

Publishing container services on privileged host ports (1–1023) requires elevated privileges on the host OS and may conflict with well-known system services, increasing the risk of port conflicts and unintended service exposure. Services should map to unprivileged host ports (1024 and above) wherever possible. Port mappings where the host port falls within the 1–1023 range will be flagged.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
services:
  target_only:
    image: alpine
    ports: ['80']
  unprivileged_host:
    image: alpine
    ports: ['8080:80']
  unprivileged_host_range:
    image: alpine
    ports: ['2000-2100:80-180']
  privileged_target_only:
    image: alpine
    ports:
      - target: 80
        published: 8080
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
services:
  privileged_scalar:
    image: alpine
    ports: ['80:8080']
    cap_drop: [NET_BIND_SERVICE]
  overlapping_privileged_range:
    image: alpine
    ports: ['1000-1100:2000-2100/udp']
  privileged_ipv6_long:
    image: alpine
    ports:
      - target: 8080
        published: '443'
        host_ip: '::1'
        protocol: tcp
```