Security

Service uses host IPC namespace. Container shares inter-process communication with host.

Service does not have 'no-new-privileges:true' in security_opt. This allows

Service has 'label:disable' in security_opt, which disables SELinux mandatory

Service has writable root filesystem. Consider making it read-only for better security.

Service adds dangerous capability. These capabilities can be used for container escape or privilege escalation.

Service mounts Docker socket. The owner of this socket is root. Giving container access to it is equivalent to giving unrestricted root access to host.

Service uses host network mode. Container shares host network stack, bypassing network isolation.

Service uses host PID namespace. Container can see and potentially signal host processes.

Service is running in privileged mode. This grants container equivalent of root capabilities on the host machine. Can lead to container escapes and privilege escalation.

Service disables seccomp profile. Container can use all system calls, increasing attack surface.