CV-C001: Privileged mode enabled
Error Security
Why This Matters
Running a container in privileged mode grants it all Linux kernel capabilities and access to host devices. This effectively disables container isolation and allows the container to do almost anything the host can do. An attacker who compromises a privileged container gains full root access to the host system. CWE-250: Execution with Unnecessary Privileges.
How to Fix
Remove privileged: true and use specific capabilities via cap_add instead
Before (incorrect)
services:
web:
privileged: trueAfter (correct)
services:
web:
cap_add:
- NET_BIND_SERVICERule Details
- Rule Code
- CV-C001
- Severity
- Error
- Category
- Security