Rules / GL056

GL056 docker run --privileged in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-250 – Execution with Unnecessary Privileges

Risk

Running docker run --privileged inside a CI script grants the container full access to the host kernel — all Linux capabilities are enabled and device access is unrestricted. Any compromised dependency, injected variable, or malicious script running in that job can escape the container, access the runner host filesystem, read secrets from other jobs, or pivot to the broader network.

This is distinct from GL031 (TLS disabled on the Docker daemon) and GL054 (docker-in-docker service implies a privileged runner) — it is a direct, explicit privilege escalation in the script itself, not an implied runner configuration.

Trigger example

test:
  script:
    - docker run --privileged myimage ./run-tests.sh

--privileged=true is also flagged; --privileged=false and --privileged=0 are not.

Safe alternative

Use the minimal set of capabilities actually required:

test:
  script:
    - docker run --cap-add NET_ADMIN myimage ./run-tests.sh

Or redesign the job to avoid requiring elevated privileges entirely — e.g. rootless container tools (Podman, Buildah, Kaniko).

Notes

• Severity is warn — there are legitimate uses (e.g. system-level integration tests), but --privileged in a pipeline script should always be a deliberate, documented decision.
• This is a script-line rule and assumes POSIX shell; see the README Shell assumptions note.
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL056 when privileged execution is a justified requirement.

Documentation for glsec 1.23.0. Source of this page · Rule implementation