Privileged or host-mounted container configuration
CriticalAV-RUNTIME-007Runtime safetyCore pack
What it finds
`privileged: true`, `--privileged`, `hostPath`, `docker.sock` mount, or `hostNetwork: true`.
Why it matters
A privileged or host-mounted container removes isolation between the agent process and the host — a compromised agent becomes a compromised host.
How to fix it
Run unprivileged with no host mounts; grant only the specific capabilities the workload requires.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- PRIVILEGED_CONTAINER_CONFIG
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Docker/Kubernetes deployment configuration
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High
- Unsandboxed browser automationAV-RUNTIME-008 · High