---
title: >-
  Container runtime should include the --pids-limit flag for cgroup limit
  parameter
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Container runtime should include the
  --pids-limit flag for cgroup limit parameter
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Container runtime should include the --pids-limit flag for cgroup limit parameter
Classification:complianceFramework:cis-dockerControl:5.29 
## Description{% #description %}

Running containers should have a PIDs limit.

## Rationale{% #rationale %}

A container without a PIDs limit can create processes until the host runs out, as a fork bomb does.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet | xargs docker inspect --format '{{ .Name }}: PidsLimit={{ .HostConfig.PidsLimit }}'
```

Datadog checks the running containers. It passes the rule when a container's PIDs limit is above 0 and fails it otherwise.

## Remediation{% #remediation %}

Run the container with `--pids-limit`:

```bash
docker run --pids-limit 100 <image>
```

## Impact{% #impact %}

A container that reaches the limit cannot start more processes.

## Default value{% #default-value %}

Containers can create as many processes as the host allows.

## References{% #references %}

1. [https://docs.docker.com/reference/cli/docker/container/run/](https://docs.docker.com/reference/cli/docker/container/run/)