XEIZE
/Vulnerability documentation/IaC/Docker Compose/Shared host user namespace

Shared host user namespace

Reduce host user-namespace exceptions and verify the actual UID mappings.

Description

User namespaces map container users to host users. Sharing the host namespace directly can weaken the privilege boundary.

When the Docker daemon uses userns-remap, userns_mode: host disables remapping for that container. Closer alignment with host identities can increase the impact of a container compromise.

Potential impact

  • The privilege boundary between container and host users may be weakened.
  • A privilege-related vulnerability may have a greater effect on the host.
  • Tracking user privileges and managing isolation policies may become harder.

Remediation

  • Remove unnecessary userns_mode: host and check the daemon’s userns-remap settings and actual UID/GID mappings. Omitting the field does not itself enable remapping.
  • Consider user remapping or rootless operation when addressing permission problems, and test bind-mount ownership and compatibility.
  • Manage namespace exceptions separately for debugging and production environments.

Examples

The examples compare the presence and absence of a per-container host exception. Check the image and host user-namespace settings together.

Before

yaml
services:
  service1:
    image: service1:3.4
    userns_mode: host

After

yaml
services:
  service1:
    image: service1:3.4

Explanation:

  • Before: This container disables remapping even when the daemon uses userns-remap.
  • After: Removing the host exception follows the daemon configuration. Actual user remapping requires the corresponding daemon setting.

References

XEIZE DocumentationTechnical support