turbot/docker_compliance
GitHub
Loading controls...

Control: 5.31 Ensure that the host's user namespaces are not shared

Description

You should not share the host's user namespaces with containers running on it.

User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container does not therefore isolate users on the host from users in the containers.

Remediation

You should not share user namespaces between host and containers. For example, you should not run the command below:

docker run --rm -it --userns=host ubuntu bash

Default Value

By default, the host user namespace is shared with containers unless user namespace support is enabled.

Usage

Run the control in your terminal:

steampipe check docker_compliance.control.cis_v160_5_31

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share docker_compliance.control.cis_v160_5_31

SQL

This control uses a named query:

docker_container_host_user_namespace_shared

Tags