Privileged compose service (ARCH10011)

Key config.compose.privileged · Severity error · Category security · CWE CWE-250

A privileged container reaches every device and kernel capability of the host. Breaking out of it is a matter of configuration, not an exploit.

Incorrect

services:
  agent:
    image: example/agent:2.4.1
    privileged: true

Correct

services:
  agent:
    image: example/agent:2.4.1
    cap_add:
      - NET_ADMIN

Fix

Remove privileged and grant only the capability the service needs (cap_add).