---
title: Shared host cgroup namespace
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > Shared host cgroup namespace
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Shared host cgroup namespace

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `dockercompose-shared-host-cgroup-namespace` 

**Platform:** DockerCompose

**Severity:** Medium

**Category:** Resource Management

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.docker.com/reference/compose-file/services/#cgroup)

### Description{% #description %}

Sharing the host cgroup namespace (`cgroup: host` or legacy `cgroupns_mode: host`) allows a container to read and interact with the host's entire cgroup hierarchy, exposing resource accounting data for host processes and potentially enabling manipulation of resource limits outside the container's scope. This weakens isolation and can be exploited to interfere with host-level resource allocation. Services should omit these fields or avoid setting them to `host`.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
services:
  private:
    image: alpine
    cgroup: private
  default:
    image: alpine
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
services:
  risky:
    image: alpine
    cgroup: host
  legacy_risky:
    image: alpine
    cgroupns_mode: host
```