{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
        "slug": "include-host-swap-in-docker-tmpfs-confidentiality-reviews",
        "url": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/include-host-swap-in-docker-tmpfs-confidentiality-reviews/"
        },
        "title": "Include host swap in Docker tmpfs confidentiality reviews",
        "summary": "Memory-backed temporary files are not automatically excluded from every disk path.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:05+00:00",
        "modified_at": "2026-10-20T18:34:32+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 258,
        "potentially_affected": "Review Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.",
        "dse_recommendation": "DSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data.",
        "primary_source": {
            "name": "Docker documentation — tmpfs mounts",
            "url": "https://docs.docker.com/engine/storage/tmpfs/",
            "published_on": null,
            "authority": "docs.docker.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Memory-backed temporary files are not automatically excluded from every disk path.</p>\n<h2>Source facts</h2>\n<p>Docker tmpfs mounts store temporary data in memory and remove their contents when the container stops. Docker notes that the Linux tmpfs implementation can write data to swap, allowing it to reach a filesystem. Memory-backed storage also counts toward the container’s memory cgroup allowance; a larger mount size does not supply additional physical memory.</p>\n<p>Source: <a href=\"https://docs.docker.com/engine/storage/tmpfs/\">Docker documentation — tmpfs mounts</a>.</p>\n<h2>Applicability</h2>\n<p>Review Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data. Give each temporary directory a size expectation and cleanup owner. Do not use memory placement alone as the stated confidentiality control. Check whether the application can regenerate the data after a stop and whether a memory-pressure event could interrupt work. Keep durable records on a separately designed persistence path instead of assuming the temporary mount will survive container replacement.</p>\n<h2>Verification</h2>\n<p>In an isolated test, inspect mount options, host swap configuration, and container memory accounting. Fill only a safe amount of disposable data, observe memory usage, then stop and recreate the container to confirm expected loss. Record the confidentiality boundary without collecting real secret contents in diagnostics. Have the platform owner record the approved swap and memory policy beside the mount definition. Keep the recovery expectation explicit: identify which temporary artifacts should disappear and which business records must be reconstructed or stored elsewhere.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.docker.com/engine/storage/tmpfs/\">Docker documentation — tmpfs mounts</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Memory-backed temporary files are not automatically excluded from every disk path.\nSource facts\nDocker tmpfs mounts store temporary data in memory and remove their contents when the container stops. Docker notes that the Linux tmpfs implementation can write data to swap, allowing it to reach a filesystem. Memory-backed storage also counts toward the container’s memory cgroup allowance; a larger mount size does not supply additional physical memory.\nSource: Docker documentation — tmpfs mounts.\nApplicability\nReview Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.\nDSE recommendation\nDSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data. Give each temporary directory a size expectation and cleanup owner. Do not use memory placement alone as the stated confidentiality control. Check whether the application can regenerate the data after a stop and whether a memory-pressure event could interrupt work. Keep durable records on a separately designed persistence path instead of assuming the temporary mount will survive container replacement.\nVerification\nIn an isolated test, inspect mount options, host swap configuration, and container memory accounting. Fill only a safe amount of disposable data, observe memory usage, then stop and recreate the container to confirm expected loss. Record the confidentiality boundary without collecting real secret contents in diagnostics. Have the platform owner record the approved swap and memory policy beside the mount definition. Keep the recovery expectation explicit: identify which temporary artifacts should disappear and which business records must be reconstructed or stored elsewhere.\nOfficial reference\nDocker documentation — tmpfs mounts. Reviewed October 20, 2026.",
        "content_markdown": "Memory-backed temporary files are not automatically excluded from every disk path.\n\n## Source facts\n\nDocker tmpfs mounts store temporary data in memory and remove their contents when the container stops. Docker notes that the Linux tmpfs implementation can write data to swap, allowing it to reach a filesystem. Memory-backed storage also counts toward the container’s memory cgroup allowance; a larger mount size does not supply additional physical memory.\n\nSource: [Docker documentation — tmpfs mounts](https://docs.docker.com/engine/storage/tmpfs/).\n\n## Applicability\n\nReview Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.\n\n## DSE recommendation\n\nDSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data. Give each temporary directory a size expectation and cleanup owner. Do not use memory placement alone as the stated confidentiality control. Check whether the application can regenerate the data after a stop and whether a memory-pressure event could interrupt work. Keep durable records on a separately designed persistence path instead of assuming the temporary mount will survive container replacement.\n\n## Verification\n\nIn an isolated test, inspect mount options, host swap configuration, and container memory accounting. Fill only a safe amount of disposable data, observe memory usage, then stop and recreate the container to confirm expected loss. Record the confidentiality boundary without collecting real secret contents in diagnostics. Have the platform owner record the approved swap and memory policy beside the mount definition. Keep the recovery expectation explicit: identify which temporary artifacts should disappear and which business records must be reconstructed or stored elsewhere.\n\n## Official reference\n\n[Docker documentation — tmpfs mounts](https://docs.docker.com/engine/storage/tmpfs/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
                "url": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Include host swap in Docker tmpfs confidentiality reviews",
                        "item": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/#article",
                "identifier": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
                "url": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/",
                "headline": "Include host swap in Docker tmpfs confidentiality reviews",
                "description": "Memory-backed temporary files are not automatically excluded from every disk path.",
                "abstract": "Memory-backed temporary files are not automatically excluded from every disk path.",
                "articleBody": "Memory-backed temporary files are not automatically excluded from every disk path.\nSource facts\nDocker tmpfs mounts store temporary data in memory and remove their contents when the container stops. Docker notes that the Linux tmpfs implementation can write data to swap, allowing it to reach a filesystem. Memory-backed storage also counts toward the container’s memory cgroup allowance; a larger mount size does not supply additional physical memory.\nSource: Docker documentation — tmpfs mounts.\nApplicability\nReview Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.\nDSE recommendation\nDSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data. Give each temporary directory a size expectation and cleanup owner. Do not use memory placement alone as the stated confidentiality control. Check whether the application can regenerate the data after a stop and whether a memory-pressure event could interrupt work. Keep durable records on a separately designed persistence path instead of assuming the temporary mount will survive container replacement.\nVerification\nIn an isolated test, inspect mount options, host swap configuration, and container memory accounting. Fill only a safe amount of disposable data, observe memory usage, then stop and recreate the container to confirm expected loss. Record the confidentiality boundary without collecting real secret contents in diagnostics. Have the platform owner record the approved swap and memory policy beside the mount definition. Keep the recovery expectation explicit: identify which temporary artifacts should disappear and which business records must be reconstructed or stored elsewhere.\nOfficial reference\nDocker documentation — tmpfs mounts. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:05+00:00",
                "dateModified": "2026-10-20T18:34:32+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/include-host-swap-in-docker-tmpfs-confidentiality-reviews/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Include host swap in Docker tmpfs confidentiality reviews"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 258,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Docker documentation — tmpfs mounts",
                    "url": "https://docs.docker.com/engine/storage/tmpfs/"
                }
            }
        ]
    }
}