# CL-0010: Host Namespace Sharing

**Severity:** HIGH

**References:**
- [OWASP Docker Security Rule #3](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-3-limit-capabilities-grant-only-specific-capabilities-needed-by-a-container)
- CIS Docker Benchmark 5.16 — Ensure that the host's process namespace is not shared
- CIS Docker Benchmark 5.17 — Ensure that the host's IPC namespace is not shared
- CIS Docker Benchmark 5.31 — Ensure that the host's user namespaces are not shared
- CIS Docker Benchmark 5.21 — Ensure that the host's UTS namespace is not shared

## What it detects

Any service with:
- `pid: host` — shares the host's PID namespace
- `ipc: host` — shares the host's IPC namespace
- `userns_mode: host` — disables user namespace remapping
- `uts: host` — shares the host's UTS namespace

Other values (e.g., `ipc: shareable`) are not flagged.

## Why it matters

Linux namespaces are a core container isolation mechanism. Sharing them with the host removes that boundary:

### `pid: host`
The container can see all processes on the host, send signals to them (including SIGKILL), and read process environment variables (which often contain secrets) via `/proc/[pid]/environ`.

### `ipc: host`
The container can attach to host shared memory segments, potentially reading sensitive data from other applications or injecting data into them.

### `userns_mode: host`
Disables daemon-configured user-namespace remapping for this container. **This only matters if the daemon is configured with `userns-remap`** — by default, Docker installs do not remap UIDs at all, so this directive is mostly a flag of intent on a default install. On hosts where userns-remap *is* configured, `userns_mode: host` makes container UID 0 equal to host UID 0 again (instead of the remapped UID like 100000), turning every container-escape primitive into trivial host root.

Treat any explicit `userns_mode: host` as a strong signal — either the operator has remap configured and is opting out, or they have copy-pasted a config without understanding it. Both warrant a finding.

### `uts: host`
The container shares the host's UTS namespace and can change the host's hostname via `sethostname()`. This can disrupt host identity, break TLS certificate validation, and interfere with services that rely on hostname for configuration.

## Fix

Remove the namespace sharing directive:

```yaml
# Before
services:
  monitor:
    image: myapp:1.0
    pid: host
    ipc: host
    uts: host

# After
services:
  monitor:
    image: myapp:1.0
```

If your application requires cross-container PID visibility (e.g., sidecar patterns), use `pid: "service:other-container"` instead of `pid: host` to limit the scope.

## Out of scope

Compose also accepts `cgroup: host` (cgroup-namespace sharing). This rule does not currently flag it — CIS does not benchmark it specifically and the threat model is narrower than the four namespaces above. It is still a hardening regression and may be covered in a future rule.

## See also

- [CL-0008](CL-0008.md) — `network_mode: host` (host network namespace)
- [CL-0002](CL-0002.md) — `privileged: true` (often combined with these directives)
