Docker: --ipc=host and security

In terms of attack surface --ipc=host removes a layer of security and creates new attack vectors as any application running on the host that misbehaves when presented with malicious data in shared memory segments can become a potential attack vector.

Performance-sensitive programs use shared memory to store and exchange volatile data (x11 frame buffers are one example). In your case the non-root user in the container has access to the x11 server shared memory.

Running as non-root inside the container should somewhat limit unauthorized access, assuming correct permissions are set on all shared objects. Nonetheless if an attacker gained root privileges inside your container they would have access to all shared objects owned by root (some objects might still be restricted by the IPC_OWNER capability which is not enabled by default).

You may ask yourself for each application on the host :

• What are the odds of a compromise from maliciously crafted shared memory segments?

• What are the consequences of a compromise? Is the application confined in any way?

As long as your image of the container is from a reliable source it shouldn't affect your host.

You can read about the ipc settings here..

https://docs.docker.com/engine/reference/run/#ipc-settings---ipc