Host Namespace is Shared
- Query id: 4f31dd9f-2cc3-4751-9b53-67e4af83dac0
- Query name: Host Namespace is Shared
- Platform: DockerCompose
- Severity: Medium
- Category: Resource Management
- CWE: 250
- URL: Github
Description¶
The hosts process namespace should not be shared by containers
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - yaml file
version: '3'
services:
service_name_1:
image: not/a-real-image:latest
command: ["launch"]
ports:
- "8080:8080"
pid: "host" # Share Process ID Namespace
Positive test num. 2 - yaml file
version: "2.4"
services:
service_name_2:
build: ./
restart: always
pid: "host"
entrypoint: node /app/directory.js
volumes:
- "./directory:/app"
Positive test num. 3 - yaml file
version: "3"
services:
app:
build: app
ports:
- "0.0.0.0:80:80"
internal:
build: internal
pid: "host"
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
version: '2.1'
services:
service_name_4:
image: not/a-real-image:latest
command: ["launch"]
ports:
- "8080:8080"
pid: "container:container_name_4"