ollama - 💡(How to fix) Fix [HIGH] Docker container runs as root with API exposed on all interfaces

Severity: HIGH -- CVSS 8.8

Location: Dockerfile (final stage), envconfig/config.go (Host function) Category: Container Security / Privilege Escalation Confidence: Certain CWE: CWE-250 MITRE ATT&CK: T1611, T1078

Description

The Docker image runs ollama as root with no USER directive, and sets OLLAMA_HOST=0.0.0.0:11434 which binds the API to all network interfaces:

FROM ubuntu:24.04
ENV OLLAMA_HOST=0.0.0.0:11434
EXPOSE 11434
ENTRYPOINT ["/bin/ollama"]
CMD ["serve"]

There is no USER directive switching to a non-root user. Combined with no authentication by default (see related finding), anyone who can reach port 11434 on the container can run arbitrary model inference, pull/delete models from a root context.

Impact

• Container escape paths are wider when running as root
• GPU device access gives root-level hardware access
• If runner has any memory corruption bug (C/C++ llama.cpp backend), exploitation yields host root if --privileged or host device mounts are used
• Model data accessible to any container on the same Docker network

Remediation

1. Add a non-root user in the Dockerfile:

   RUN useradd -r -s /bin/false ollama
   USER ollama

2. Default OLLAMA_HOST to 127.0.0.1:11434 in the Docker image (users can override)
3. Document that --user flag or user: in docker-compose should be used
4. Add HEALTHCHECK directive
5. Consider readOnlyRootFilesystem: true in Kubernetes deployments

Found as part of a broader security audit of ollama/ollama.