SH011: Risky docker-compose service configuration

Severity: high · Category: security · Applies to: docker

Why it matters

Privileged containers, host networking, the Docker socket and publicly bound database ports each give an attacker a way past the container boundary or straight to your data.

How to fix

Drop privileged/host settings, bind ports to 127.0.0.1, and keep databases on an internal network.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH011

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH011