Metadata

Id: dockercompose-shared-host-ipc-namespace

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Sharing the host IPC (inter-process communication) namespace (ipc: host) allows a container to access the shared memory segments, semaphores, and message queues that host processes use for communication. This can lead to cross-process data leakage, enabling a compromised container to intercept or inject data into host IPC channels. Services should omit the ipc field or restrict it to container-local IPC rather than host.

Compliant Code Examples

services:
  private:
    image: alpine
    ipc: private
  shareable:
    image: alpine
    ipc: shareable

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    ipc: host