---
title: "HOST-CTR-012 Containers Run Without Memory or Process Limits"
canonical: https://openvapt.com/checks/HOST-CTR-012.html
html: https://openvapt.com/checks/HOST-CTR-012.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-CTR-012 Containers Run Without Memory or Process Limits

Looks for containers with no memory limit and no PID limit.

- Domain: Server
- Severity: Medium
- Control category: Secure Configuration
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-770
- NIST SP 800-53 Rev. 5: SC-6, SC-5
- Benchmark topic: CIS Docker Benchmark 5.11 and 5.29 (memory limit; PIDs cgroup limit) (topic only, no benchmark text)

## Why It Matters

A container with no limits can use all the host's memory or fork until the kernel runs out of process slots, taking the host and every neighbour down (a fork bomb or a memory leak is enough). Limits turn that into a problem for one container.

## How It Detects

Reads Memory and PidsLimit from each container's hostconfig.json (needs root) and fails when both are zero or unset.

## How to Fix

Recreate each container with --memory (for example 512m) and --pids-limit (for example 256), or set them in the compose file under deploy.resources.limits / pids_limit.

## How to Verify

```
docker inspect --format '{{.Name}} mem={{.HostConfig.Memory}} pids={{.HostConfig.PidsLimit}}' $(docker ps -aq)
```

## Learn the Theory

- [P9 Containers and Kubernetes](https://openvapt.com/academy/p9.md)
- [A5 Container Runtime Hardening Depth](https://openvapt.com/academy/a5.md)

## References

- [Docker documentation, Resource constraints](https://docs.docker.com/engine/containers/resource_constraints/)
- [NIST SP 800-190, Application Container Security Guide](https://csrc.nist.gov/pubs/sp/800/190/final)
- [CIS Docker Benchmark (referenced by recommendation number)](https://www.cisecurity.org/benchmark/docker)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go

Run it: `openvapt scan --only HOST-CTR-012`. Read it offline: `openvapt explain HOST-CTR-012`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-CTR-012.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.