tmpfs mount allows exec, suid, or device access

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-tmpfs-exec-enabled

Platform: DockerCompose

Severity: Low

Category: Resource Management

Learn More

Description

Docker applies noexec,nosuid,nodev to tmpfs mounts by default. Explicitly overriding those protections with exec, suid, or dev turns writable temporary storage into an execution or privilege-escalation vector. Services should remove these unsafe options and retain Docker’s secure defaults.

Compliant Code Examples

services:
  default_options:
    image: alpine
    tmpfs:
      - /tmp
      - /run:size=1m
  explicitly_restricted:
    image: alpine
    tmpfs:
      - /tmp:noexec,nosuid,nodev
      - /run:noexec,nosuid,nodev,size=1m
  long_syntax:
    image: alpine
    volumes:
      - type: tmpfs
        target: /cache

Non-Compliant Code Examples

services:
  exec_enabled:
    image: alpine
    tmpfs:
      - /tmp:exec
  suid_enabled:
    image: alpine
    tmpfs:
      - /run:rw,suid,size=1m
  devices_enabled:
    image: alpine
    tmpfs: /cache:dev