---
title: Containers should not run in privileged mode
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should not run in privileged
  mode
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should not run in privileged mode
Classification:complianceFramework:cis-dockerControl:5.5 
## Description{% #description %}

Containers should run unprivileged.

## Rationale{% #rationale %}

A privileged container has every capability and every device of the host, and its processes can take over the host.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: Privileged={{ .HostConfig.Privileged }}'
```

Datadog passes the rule when a container is unprivileged and fails it otherwise.

## Remediation{% #remediation %}

Run the container without `--privileged`, and grant only the capabilities or devices it needs.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Containers run unprivileged.

## References{% #references %}

1. [https://docs.docker.com/engine/containers/run/#runtime-privilege-and-linux-capabilities](https://docs.docker.com/engine/containers/run/#runtime-privilege-and-linux-capabilities)