Ensure that the host's process namespace is not shared

HighLevel 1Automateddocker

Description

Sharing the host's PID namespace lets the container see and signal every host process. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.

How it is checked

Audit method: Shell command

shell

ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}} {{.HostConfig.PidMode}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '$2=="host"{print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Redeploy without --pid=host (compose: remove 'pid: host').

Properties

Operating systems: Any
Tags: dockerruntime
Reference: CIS Docker Benchmark v1.9.0 - 5.16 Ensure that the host's process namespace is not shared

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker