Rules / GL061

GL061 docker run --pid host in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-653 – Improper Isolation or Compartmentalization

Risk

docker run --pid host makes the container share the host's PID namespace. The container can see and interact with all processes running on the runner host — including processes from other CI jobs, the GitLab Runner agent itself, and any privileged system processes. Combined with /proc access this allows reading memory of other processes, injecting code, or killing critical services.

Trigger example

test:
  script:
    - docker run --pid host myimage ./perf-test.sh

Both --pid host and --pid=host are detected.

Safe alternative

Omit --pid (the default is an isolated PID namespace). If process visibility is genuinely needed for profiling or debugging, scope it to a specific container rather than the host:

test:
  script:
    - docker run --pid container:abc123 myimage ./profile.sh

Notes

• Severity is warn.
• Related: GL056 (--privileged), GL057 (--cap-add SYS_PTRACE).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL061.

Documentation for glsec 1.23.0. Source of this page · Rule implementation