Details
https://docs.docker.com/reference/run/#pid-settings
2.http://man7.org/linux/man-pages/man7/pid_namespaces.7.html
Solution
Do not start a container with ‘–pid=host’ argument.
For example, do not start a container as below-
docker run –interactive –tty –pid=host centos /bin/bash
Impact-
Container processes cannot see the processes on the host system.In certain cases you want your container to share the host’s process namespace. For example, you could build a container with debugging tools like strace or gdb, but want to use these tools when debugging processes within the container. If this is desired, then share only one (or needed) host process by using the ‘-p’ switch.
For example,
docker run –pid=host rhel7 strace -p 1234
Default Value-
By default, all containers have the PID namespace enabled and the host’s process namespace is not shared with the containers.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.