Volume has sensitive host directory

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-volume-has-sensitive-host-directory

Platform: DockerCompose

Severity: High

Category: Access Control

Learn More

Description

Mounting sensitive host directories—such as /etc, /root, /boot, /var/run, or /proc—into a container exposes critical system configuration, credentials, and runtime state to container processes. An attacker with container access could read or modify these files to escalate privileges, exfiltrate credentials, or persist on the host. Both inline bind mounts (e.g., /etc:/mnt/etc) and named volumes whose host source resolves to a sensitive path are detected.

Compliant Code Examples

services:
  lookalike:
    image: alpine
    volumes: ['/various:/data']
  relative:
    image: alpine
    volumes: ['./etc:/data']
  anonymous_target:
    image: alpine
    volumes: ['/etc']
  named_volume:
    image: alpine
    volumes: [etcdata:/etc]
  application_data:
    image: postgres
    volumes:
      - /var/lib/postgresql/data:/var/lib/postgresql/data
      - /home/app/data:/data
      - /srv/application:/srv/application
      - /tmp/../home/app/data:/data
  engine_socket:
    image: alpine
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - engine_socket:/run/docker.sock
  localtime:
    image: alpine
    volumes:
      - /etc/localtime:/etc/localtime:ro
  timezone:
    image: alpine
    volumes:
      - type: bind
        source: /etc/timezone
        target: /etc/timezone
        read_only: true
  zoneinfo:
    image: alpine
    volumes:
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - /usr/share/zoneinfo/Etc/UTC:/etc/localtime:ro
  ca_certificates:
    image: alpine
    volumes:
      - ca_certificates:/etc/ssl/certs
      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
volumes:
  etcdata: {}
  engine_socket:
    driver_opts:
      type: none
      device: /run/docker.sock
      o: bind
  ca_certificates:
    driver_opts:
      type: none
      device: /etc/ssl/certs
      o: bind,ro

Non-Compliant Code Examples

services:
  short_etc:
    image: alpine
    volumes: ['/etc:/host/etc:ro']
  long_runtime:
    image: alpine
    volumes:
      - type: bind
        source: /var/run
        target: /data
  named_bind:
    image: alpine
    volumes: [hostproc:/host/proc]
  writable_common_file:
    image: alpine
    volumes:
      - /etc/localtime:/etc/localtime
  dotted_etc:
    image: alpine
    volumes:
      - /tmp/../etc:/host/etc:ro
  lib64_mount:
    image: alpine
    volumes:
      - /lib64:/host/lib64:ro
  named_rbind:
    image: alpine
    volumes: [hostetc:/host/etc]
  engine_state:
    image: alpine
    volumes:
      - /var/lib/docker:/host/docker
  containerd_state:
    image: alpine
    volumes:
      - /var/lib/containerd:/host/containerd
volumes:
  hostproc:
    driver_opts:
      type: none
      o: bind,rw
      device: /proc
  hostetc:
    driver_opts:
      type: none
      o: rbind
      device: /etc