---
title: Containers should use the cgroup configured in Docker
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should use the cgroup
  configured in Docker
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should use the cgroup configured in Docker
Classification:complianceFramework:cis-dockerControl:5.25 
## Description{% #description %}

Containers should run in the cgroup that Docker gives them.

## Rationale{% #rationale %}

Docker places every container in a cgroup of its own, where the resource limits of the container apply. A container under another parent cgroup takes the permissions and resources of that parent, which can exceed those of the parent that Docker sets.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: CgroupParent={{ .HostConfig.CgroupParent }}'
```

Datadog passes the rule when a container's cgroup parent is empty and fails it otherwise.

## Remediation{% #remediation %}

Run the container without `--cgroup-parent`, unless a parent cgroup is set on purpose and reviewed.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Containers run under the default parent cgroup.

## References{% #references %}

1. [https://docs.docker.com/engine/containers/run/#specify-custom-cgroups](https://docs.docker.com/engine/containers/run/#specify-custom-cgroups)