---
title: Containers should not share the host's user namespaces
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should not share the host's
  user namespaces
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should not share the host's user namespaces
Classification:complianceFramework:cis-dockerControl:5.31 
## Description{% #description %}

Containers should run in the user namespace that Docker gives them, without `--userns=host`.

## Rationale{% #rationale %}

With user namespace remapping, root in a container is unprivileged on the host. A container in the host user namespace undoes that, and its root is root on the host.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: UsernsMode={{ .HostConfig.UsernsMode }}'
```

Datadog passes the rule when a container's user namespace mode is other than `host` and fails it otherwise.

## Remediation{% #remediation %}

Run the container without `--userns=host`.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Containers run in the user namespace that Docker gives them.

## References{% #references %}

1. [https://docs.docker.com/engine/security/userns-remap/](https://docs.docker.com/engine/security/userns-remap/)
1. [https://docs.docker.com/reference/cli/docker/container/run/#options](https://docs.docker.com/reference/cli/docker/container/run/#options)