Compose service adds a host-equivalent capability
ID |
compose_added_capabilities |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
low |
Vendor |
Docker |
Resource |
General Security |
Tags |
ASVS50:v13.1.1, reachable |
Description
A Docker Compose service adds a Linux capability that lifts the container’s isolation to the point
where it can take the host: SYS_ADMIN (most privileged operations, mount included), ALL,
SYS_PTRACE (inspect and manipulate host processes) or SYS_MODULE (load kernel modules).
Narrower additions such as NET_BIND_SERVICE or CHOWN are ordinary and are not reported.
Mitigation / Fix
Drop every capability and add back only the narrow ones the service needs:
services:
toolchain:
image: example/toolchain:1.2.3
cap_drop: [ALL]
cap_add: [CHOWN, SETUID, SETGID]A service that needs SYS_ADMIN to mount a filesystem can usually be given the mount by the host
instead, as a volume.