All checks
High
ECS task definitions should not share the host's process namespace
Flags ECS task definitions configured to share the host's process namespace with their containers.
- service
- ECS
- severity
- High
- scope
- evaluated in every region
How to fix it
Leave pidMode out of the family's latest active revision, which gives every container its own process namespace, or set it to task, which lets the containers of one task see each other's processes but not the host's. Both pass; only host fails. Anything relying on host process visibility, such as a sidecar reading /proc, stops working. This needs a new revision, with every service and scheduled task repointed at it.
In the console
ECS → Task definitions → the family → the latest revision → Create new revision
See which of your accounts this check is failing on.
Book a demo