Metadata

Id: dockercompose-shared-host-cgroup-namespace

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Sharing the host cgroup namespace (cgroup: host or legacy cgroupns_mode: host) allows a container to read and interact with the host’s entire cgroup hierarchy, exposing resource accounting data for host processes and potentially enabling manipulation of resource limits outside the container’s scope. This weakens isolation and can be exploited to interfere with host-level resource allocation. Services should omit these fields or avoid setting them to host.

Compliant Code Examples

services:
  private:
    image: alpine
    cgroup: private
  default:
    image: alpine

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    cgroup: host
  legacy_risky:
    image: alpine
    cgroupns_mode: host