Skip to content

SEC-004.md

Latest commit

 

History

History
31 lines (18 loc) · 941 Bytes

SEC-004.md

File metadata and controls

31 lines (18 loc) · 941 Bytes

SEC-004 Pod runs as root

Summary

A pod is configured to run as root (e.g. securityContext.runAsUser: 0). Root in the container increases risk if the container is compromised or escapes.

Severity

Warning

Example

N/A

Symptoms

  • Report shows: Pod <ns>/<name> runs as root
  • Pod or container securityContext.runAsUser is 0 or unset with root default

Resolution

  1. Set securityContext.runAsNonRoot: true and runAsUser to a non-zero UID
  2. Build images to run as a non-root user; avoid requiring root for application logic
  3. Use Pod Security Standards/Admission to enforce runAsNonRoot
  4. If root is required for legacy workloads, isolate in dedicated namespaces and restrict network

References