Metadata

Id: dockercompose-shared-host-user-namespace

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Setting userns_mode: host disables user namespace remapping for a service, causing container user IDs—including root (UID 0)—to map directly to the same UIDs on the host. A container process running as root inside the container therefore has root-level privileges on the host, significantly increasing the impact of a container compromise. Services should omit userns_mode or use a remapped namespace to maintain user isolation.

Compliant Code Examples

services:
  private:
    image: alpine
    userns_mode: private
  default:
    image: alpine

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    userns_mode: host