rules:
- id: seccomp-confinement-disabled
  patterns:
  - pattern-inside: |
      version: ...
      ...
      services:
        ...
  - pattern: |
      $SERVICE:
        ...
        image: ...
        ...
        security_opt:
          - ...
          - seccomp:unconfined
  message: >-
    Service '$SERVICE' is explicitly disabling seccomp confinement. This runs
    the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.
  metadata:
    cwe:
    - 'CWE-284: Improper Access Control'
    references:
    - https://docs.docker.com/engine/security/seccomp/
    category: security
    technology:
    - docker-compose
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages: [yaml]
  severity: WARNING