---
title: >-
  Privileged port mapping for containers should be restricted to increase
  security
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Privileged port mapping for containers
  should be restricted to increase security
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Privileged port mapping for containers should be restricted to increase security
Classification:complianceFramework:cis-dockerControl:5.8 
## Description{% #description %}

Containers should publish their ports on host ports above 1023.

## Rationale{% #rationale %}

Ports below 1024 are reserved for root on the host. A container that publishes one claims a port that clients trust as a system service.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet | xargs docker inspect --format '{{ .Name }}: Ports={{ .NetworkSettings.Ports }}'
```

Datadog checks the running containers. It passes the rule when every published host port is 1024 or above, and fails it otherwise. A load balancer that must listen on 80 or 443 fails, and needs a manual review.

## Remediation{% #remediation %}

Publish the container port on a host port of 1024 or above:

```bash
docker run -p 8080:80 <image>
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Docker publishes the host ports that the command asks for.

## References{% #references %}

1. [https://docs.docker.com/engine/network/](https://docs.docker.com/engine/network/)