Compose service shares a host namespace

ID

compose_shared_host_namespace

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Vendor

Docker

Resource

General Security

Tags

ASVS50:v13.1.1, reachable

Description

A Docker Compose service joins one of the host’s namespaces instead of getting its own:

  • pid: host — the container sees and can signal every process on the host, and can read their memory and command lines. The Compose spelling of the Kubernetes share_host_pid flaw.

  • ipc: host — the container shares the host’s shared memory and semaphores, so it can read what other processes put there. The Compose spelling of share_host_ipc.

  • userns_mode: host — user-namespace remapping is off, so root in the container is root on the host.

  • uts: host, cgroup: host — the container can change the host’s hostname, or see and escape its cgroup limits.

Examples

Reported:

services:
  monitor:
    image: example/monitor:1.2.3
    pid: host
    ipc: host

Mitigation / Fix

Leave the namespaces isolated. Where a monitoring agent genuinely needs host process visibility, that is a case for running it on the host, or for granting the narrow capability it needs with the namespaces intact.

© 2026 Xygeni. All rights reserved