---
title: Sensitive host system directories should not be mounted on containers
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Sensitive host system directories
  should not be mounted on containers
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Sensitive host system directories should not be mounted on containers
Classification:complianceFramework:cis-dockerControl:5.6 
## Description{% #description %}

Containers should mount no sensitive host directory, and none of their content read-write.

## Rationale{% #rationale %}

A container that mounts `/`, `/boot`, `/dev`, `/etc`, `/lib`, `/lib64`, `/proc`, `/sys`, or `/usr` can read the secrets of the host, and change its configuration or binaries when the mount is writable.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: Mounts={{ .Mounts }}'
```

Datadog fails the rule when a container bind-mounts one of these directories, or a path under one of them read-write, and passes it otherwise. The Datadog Agent and Cluster Agent images from the Datadog registries pass: they mount host paths by design.

## Remediation{% #remediation %}

Remove the mount, or mount the specific file or directory the workload needs, read-only.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Containers mount the host paths that their command asks for.

## References{% #references %}

1. [https://docs.docker.com/engine/storage/volumes/](https://docs.docker.com/engine/storage/volumes/)