# Cis Docker 5.6

> Ensure sensitive host system directories are not mounted on containers

- Skill: `cyberstrikeus/cis-docker-5-6` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-docker-5-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-docker-5-6/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-docker-5-6

---


# 5.6 Ensure sensitive host system directories are not mounted on containers (Manual)

## Profile Applicability

- Level 1 - Docker - Linux

## Description

You should not allow sensitive host system directories such as those listed below to be mounted as container volumes, especially in read-write mode.

```
/
/boot
/dev
/etc
/lib
/lib64
/proc
/sys
/usr
```

## Rationale

If sensitive directories are mounted in read-write mode, it could be possible to make changes to files within them. This has obvious security implications and should be avoided.

## Impact

None.

## Audit Procedure

You should run the following command:

```bash
docker ps --quiet --all | xargs docker inspect --format='{{ .Id }}: Volumes={{ .Mounts }}'
```

This command returns a list of currently mapped directories and indicates whether they are mounted in read-write mode for each container instance.

## Remediation

You should not mount directories which are security sensitive on the host within containers, especially in read-write mode.

## Default Value

Docker defaults to using a read-write volume but you can also mount a directory read-only. By default, no sensitive host directories are mounted within containers.

## References

1. https://docs.docker.com/storage/volumes/

## CIS Controls

### v8

**3 Data Protection**

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

### v7

**13 Data Protection**

Data Protection