All checks
High
ECS task definitions should not share the host's process namespace
Checks that the task definition family's latest active revision does not set pidMode to host; older revisions a service may still run are not read. Sharing the host's process namespace lets containers see every process on the instance, and could let them manipulate or terminate those processes.
- service
- ECS
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Anything that needs to see the instance's processes, such as a monitoring sidecar reading /proc, stops working, so confirm what relied on it first.
In the console
ECS → Task definitions → the family → the latest revision → Create new revision with JSON
- pidMode
- Removed (each container gets its own namespace), or task (a task's containers share one); only host fails
- Task definition
- The new revision, on each service's Update page and in each scheduled task; running tasks keep the old one
See which of your accounts this check is failing on.
Book a live scan