Rules / GL077

GL077 docker run --ipc host in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-653 – Improper Isolation or Compartmentalization

Risk

docker run --ipc host makes the container share the host's IPC (inter-process communication) namespace. The container can then read and write the host's System V / POSIX shared memory segments and message queues, and signal host processes. On a shared runner this exposes the memory of other CI jobs and the runner agent, and provides another route to affect the host.

It is the missing sibling of the namespace-sharing flags glsec already flags: GL058 (--network host) and GL061 (--pid host).

Trigger example

test:
  script:
    - docker run --ipc host myimage ./run.sh

Both --ipc host and --ipc=host are detected.

Safe alternative

Omit --ipc (the default is a private IPC namespace). If shared memory must be shared with another container — for example a sibling in the same job — scope it to that container rather than the host:

test:
  script:
    - docker run --ipc container:abc123 myimage ./run.sh

Notes

• Severity is warn.
• Related: GL058 (--network host), GL061 (--pid host), GL076 (--security-opt …=unconfined).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL077.

Documentation for glsec 1.23.0. Source of this page · Rule implementation