---
title: "Never give a container control of the host · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/no-privileged-containers
id: INF-74
level: Required
applies: servers
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 995
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Never give a container control of the host

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-74
- Level: Required
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Never run an app container with `--privileged`, the host's network or process namespace, or the container engine's socket mounted inside.
- Check: For every running container, `docker inspect --format '{{.HostConfig.Privileged}} {{.HostConfig.NetworkMode}} {{.HostConfig.PidMode}} {{.HostConfig.SecurityOpt}} {{json .Mounts}}'` shows `false`, no `host`, no `seccomp=unconfined` and no `docker.sock`.
- Risk: An account or system taken over
- Applies when: The project runs its own servers, virtual machines or containers.
- How: Each of these hands the container root on the host, so one hole in the app takes the whole machine. If a tool must start containers, such as a CI runner, give it its own machine or a rootless engine. A rootless engine, such as rootless Docker or Podman, runs the engine itself without root, so even an escape lands in an unprivileged user. Add only the one capability the app needs, such as `NET_BIND_SERVICE`, after dropping all. Set `no-new-privileges` so a program cannot gain rights through setuid. Keep Docker's default seccomp profile, which blocks about 44 system calls, and never pass `seccomp=unconfined`. Drop root inside the container too, as [Run containers as a user without root](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/non-root-containers.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
services:
  web:
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    # Never add these to an app container:
    # privileged: true
    # security_opt: [seccomp=unconfined]
    # network_mode: host
    # pid: host
    # volumes: [/var/run/docker.sock:/var/run/docker.sock]
```

## Sources

- [NIST SP 800-190 Application Container Security Guide](https://csrc.nist.gov/pubs/sp/800/190/final)
- [OWASP Docker Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)
- [Docker seccomp security profiles](https://docs.docker.com/engine/security/seccomp/)

## Related rules

- INF-73 [Run containers as a user without root](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/non-root-containers.md) in Infrastructure and environments
- INF-82 [Enforce the restricted pod security standard](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/pod-security-standards.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/no-privileged-containers">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Run containers as a user without root](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/non-root-containers.md)
- Next: [Make the container file system read-only](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/read-only-containers.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)