5.23 Ensure docker exec commands are not used with user option


Do not docker exec with --user option.
Using --user option in docker exec executes the command within the container as that user. This could potentially be insecure and unsafe to do especially when you are running containers with dropped capabilities or with enhanced restrictions.
For example, suppose your container is running as tomcat user (or any other non-root user), it would be possible to run a command through docker exec as rootwith --user=root option. This could potentially be dangerous.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


Do not use --user option in docker exec command.
Default Value:
By default, docker exec command runs without --user option.

See Also