Rules / GL060

GL060 docker run mounting sensitive host paths

Severity: error for /, /etc, /root, /proc, /sys; warn for /var/run, /dev, /boot
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-552 – Files or Directories Accessible to External Parties

Risk

Mounting sensitive host filesystem paths into a container via docker run -v breaks container isolation. A compromised job or malicious dependency can read or write host files outside the container boundary.

Particularly dangerous source paths:

• / — full root filesystem access
• /etc — read/write system config (/etc/passwd, /etc/shadow, /etc/sudoers)
• /root — root home directory including SSH keys
• /proc — host process information and kernel interfaces
• /sys — kernel and hardware control interfaces
• /var/run — runtime sockets (the Docker socket specifically is covered by GL055)

Trigger example

test:
  script:
    - docker run -v /:/host -it myimage chroot /host

Both -v and --volume are detected. The source side of the bind mount is what matters — -v /etc:/anything is flagged regardless of the destination inside the container. Subpaths count too (-v /root/.ssh:/keys).

Safe alternative

Mount only the specific project directory or a named Docker volume:

test:
  script:
    - docker run -v $CI_PROJECT_DIR:/app myimage ./test.sh

Notes

• error for /, /etc, /root, /proc, /sys; warn for /var/run, /dev, /boot.
• Named volumes (-v cache:/cache), relative paths, and non-sensitive absolute paths (/tmp/build) are not flagged.
• Related: GL055 (Docker socket mount), GL056 (--privileged).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL060.

Documentation for glsec 1.23.0. Source of this page · Rule implementation