Compose service is privileged
ID |
compose_privileged_service |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
low |
Vendor |
Docker |
Resource |
General Security |
Tags |
ASVS50:v13.1.1, reachable |
Description
A Docker Compose service declares privileged: true. A privileged container runs with all Linux
capabilities, an unconfined seccomp profile and access to the host’s devices, so a process that escapes
the application is root on the host. It is the Compose spelling of the Kubernetes
privileged_containers flaw.
Mitigation / Fix
Drop the flag and grant only what the service needs. Where a specific capability is genuinely required, add that one instead:
services:
toolchain:
image: example/toolchain:1.2.3
cap_drop: [ALL]
cap_add: [NET_BIND_SERVICE]Where a device is required, map the device rather than the whole host:
devices:
- /dev/ttyUSB0:/dev/ttyUSB0