Include host swap in Docker tmpfs confidentiality reviews

Memory-backed temporary files are not automatically excluded from every disk path.

Source facts

Docker tmpfs mounts store temporary data in memory and remove their contents when the container stops. Docker notes that the Linux tmpfs implementation can write data to swap, allowing it to reach a filesystem. Memory-backed storage also counts toward the container’s memory cgroup allowance; a larger mount size does not supply additional physical memory.

Source: Docker documentation — tmpfs mounts.

Applicability

Review Linux Docker tmpfs lifetime, memory accounting and the documented possibility of swap-file persistence.

DSE recommendation

DSE recommends examining host swap policy and memory limits when tmpfs holds credentials or other sensitive working data. Give each temporary directory a size expectation and cleanup owner. Do not use memory placement alone as the stated confidentiality control. Check whether the application can regenerate the data after a stop and whether a memory-pressure event could interrupt work. Keep durable records on a separately designed persistence path instead of assuming the temporary mount will survive container replacement.

Verification

In an isolated test, inspect mount options, host swap configuration, and container memory accounting. Fill only a safe amount of disposable data, observe memory usage, then stop and recreate the container to confirm expected loss. Record the confidentiality boundary without collecting real secret contents in diagnostics. Have the platform owner record the approved swap and memory policy beside the mount definition. Keep the recovery expectation explicit: identify which temporary artifacts should disappear and which business records must be reconstructed or stored elsewhere.

Official reference

Docker documentation — tmpfs mounts. Reviewed October 20, 2026.