Metadata

Id: dockercompose-shared-host-pid-namespace

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Setting pid: host allows a container to see and interact with all processes running on the host, including sending signals to and inspecting memory of processes outside the container. This breaks process isolation and can be exploited to disrupt host services, leak sensitive process data, or escalate privileges. Services should omit the pid field or set it to a container-scoped value instead of host.

Compliant Code Examples

services:
  private:
    image: alpine
    pid: private
  service_share:
    image: alpine
    pid: service:private

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    pid: host