---
title: Containers should have memory usage limits configured on Docker hosts
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should have memory usage
  limits configured on Docker hosts
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should have memory usage limits configured on Docker hosts
Classification:complianceFramework:cis-dockerControl:5.11 
## Description{% #description %}

Containers should have a memory limit.

## Rationale{% #rationale %}

A container without a memory limit can take the memory of the host and starve the other containers and the host itself.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: Memory={{ .HostConfig.Memory }}'
```

Datadog passes the rule when a container's memory limit is above 0 and fails it otherwise.

## Remediation{% #remediation %}

Run the container with `--memory`:

```bash
docker run --memory 256m <image>
```

## Impact{% #impact %}

The kernel kills a container that exceeds its limit.

## Default value{% #default-value %}

Containers can use all the memory of the host.

## References{% #references %}

1. [https://docs.docker.com/engine/containers/resource_constraints/#limit-a-containers-access-to-memory](https://docs.docker.com/engine/containers/resource_constraints/#limit-a-containers-access-to-memory)
1. [https://docs.docker.com/engine/containers/runmetrics/](https://docs.docker.com/engine/containers/runmetrics/)