> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="seccomp-confinement-disabled">
    Service '\$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="writable-filesystem-service">
    Service '\$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read\_only: true' to this service to prevent this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-732: Incorrect Permission Assignment for Critical Resource
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
    <br />- A06:2017 - Security Misconfiguration
  </Accordion>

  <Accordion title="selinux-separation-disabled">
    Service '\$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="privileged-service">
    Service '\$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.<br />**Likelihood**: HIGH<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-250: Execution with Unnecessary Privileges
    <br />**OWASP**: <br />- A06:2017 - Security Misconfiguration
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="no-new-privileges">
    Service '\$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security\_opt' to prevent this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-732: Incorrect Permission Assignment for Critical Resource
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
    <br />- A06:2017 - Security Misconfiguration
  </Accordion>

  <Accordion title="exposing-docker-socket-volume">
    Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-250: Execution with Unnecessary Privileges
    <br />**OWASP**: <br />- A06:2017 - Security Misconfiguration
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>
</AccordionGroup>