# CL-0012: PIDs Cgroup Limit Disabled

**Severity:** MEDIUM

**References:**
- CIS Docker Benchmark 5.29 — Ensure that the PIDs cgroup limit is used

## What it detects

Services with `pids_limit` set to a non-positive integer (`0`, `-1`, or any negative value), which disables the process count limit. Services without `pids_limit` set are not flagged — this rule targets explicit opt-outs only.

## Why it matters

Without a PIDs cgroup limit, a single container can create unlimited processes. A fork bomb inside the container will exhaust the host's process table, causing a denial of service that affects all containers and host services.

Note: most Docker installations have *no* PIDs limit by default unless the daemon is configured with `--default-pids-limit`. Setting an explicit non-positive value is an active opt-out from any default that may exist, and is what this rule flags. The absence case (no `pids_limit`) is intentionally not flagged — it would be unactionable at scale and produce noise on every typical compose file.

## Fix

Set a positive `pids_limit` appropriate for your workload:

```yaml
# Before
services:
  app:
    image: myapp:1.0
    pids_limit: -1

# After
services:
  app:
    image: myapp:1.0
    pids_limit: 200
```

Typical web applications need 100–500 PIDs. Start with a conservative limit and increase if the container hits it during normal operation.
