---
title: >-
  The container should restrict acquiring additional privileges via suid or sgid
  bits
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The container should restrict acquiring
  additional privileges via suid or sgid bits
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The container should restrict acquiring additional privileges via suid or sgid bits
Classification:complianceFramework:cis-dockerControl:5.26 
## Description{% #description %}

Containers should run with no-new-privileges.

## Rationale{% #rationale %}

With no-new-privileges, a process in the container keeps the privileges it started with: setuid and setgid binaries and file capabilities grant it nothing more.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'
```

Datadog passes the rule when a container sets `no-new-privileges` to true, or sets nothing while the daemon enables no-new-privileges for every container, and fails it otherwise. Docker applies the daemon setting when it creates a container, so a container created before the setting keeps the privileges of its creation, which `docker inspect` leaves out.

## Remediation{% #remediation %}

Run the container with `--security-opt no-new-privileges`, or set `no-new-privileges` for every container in `daemon.json`, then recreate the containers created before the setting.

## Impact{% #impact %}

Programs that need setuid binaries stop working.

## Default value{% #default-value %}

Containers can gain privileges through setuid and setgid binaries.

## References{% #references %}

1. [https://docs.docker.com/engine/containers/run/#security-configuration](https://docs.docker.com/engine/containers/run/#security-configuration)
1. [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)