Skip to content

SEC-005.md

Latest commit

 

History

History
31 lines (18 loc) · 1.09 KB

SEC-005.md

File metadata and controls

31 lines (18 loc) · 1.09 KB

SEC-005 Container runs privileged

Summary

A container runs with securityContext.privileged: true. Privileged containers have near root-equivalent power on the node and significantly increase attack surface; avoid unless strictly required.

Severity

Warning

Example

N/A

Symptoms

  • Report shows: Container <name> in pod <ns>/<pod> runs in privileged mode
  • Pod or container securityContext.privileged is true

Resolution

  1. Determine if privileged is really needed; many cases can use capabilities, read-only root filesystem, or specific volume mounts
  2. Remove securityContext.privileged: true; add only needed capabilities via securityContext.capabilities
  3. If it must remain (e.g. node-level tooling), isolate in a dedicated namespace and nodes and use network policies and audit
  4. Use Pod Security Standards/Policy to restrict or disallow privileged

References