vetkit.compose.container.host-namespace
A Compose service shares the host's PID, IPC or user namespace. The container can see and signal host processes or read host shared memory, which removes an important isolation layer.
Last updated:
Suite: Security
yaml
A Compose service shares the host's PID, IPC or user namespace. The container can see and signal host processes or read host shared memory, which removes an important isolation layer.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Remove pid: host, ipc: host and userns_mode: host unless the service is a host monitoring agent that is deliberately trusted with host-level access.
References
Source: packages/engine/rules/sast/config.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.