← Kubernetes Pod Security Check

Kubernetes pod security: privileged, hostPath, root and how to fix each

A pod spec decides how much of the node each container can touch. Most pod-related incidents are not clever exploits. They are one setting that removed a boundary, such as a privileged container, a mounted Docker socket or a password committed in plain text.

# hands the node to the container
spec:
  hostNetwork: true
  containers:
    - name: app
      image: web:latest
      securityContext:
        privileged: true

# baseline per container
      securityContext:
        allowPrivilegeEscalation: false
        runAsNonRoot: true
        runAsUser: 10001
        readOnlyRootFilesystem: true
        capabilities:
          drop: [ALL]
        seccompProfile:
          type: RuntimeDefault

The fifteen patterns a line scan can find

• k8s-privileged — privileged: true. Fix: set it false or delete it; add one capability instead. High.
• k8s-host-namespace — hostNetwork, hostPID or hostIPC true. Fix: delete it. High.
• k8s-hostpath-sensitive — hostPath of /, /etc, /root, /proc, /sys, /var/lib/kubelet or the Docker socket. Fix: emptyDir, ConfigMap, Secret or a PersistentVolumeClaim. High.
• k8s-dangerous-capability — capabilities.add of ALL, SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE or DAC_READ_SEARCH. Fix: drop: [ALL] and add back one narrow capability. High.
• k8s-literal-secret-env — a PASSWORD, SECRET, TOKEN or API_KEY set to a literal value: in env. Fix: a Secret and secretKeyRef, then rotate. The tool never prints the value. High.
• k8s-privilege-escalation — allowPrivilegeEscalation true or unset (Kubernetes defaults it to true). Fix: set it false. Medium.
• k8s-runs-as-root — runAsUser: 0, runAsNonRoot: false, or neither runAsNonRoot: true nor a non-zero runAsUser. Fix: runAsNonRoot: true and runAsUser: 10001. Medium.
• k8s-hostpath-volume — any other hostPath volume. Fix: emptyDir or a PersistentVolumeClaim, or mount it read-only. Medium.
• k8s-image-latest — an image with no tag or :latest. Fix: pin a version or digest. Medium.
• k8s-host-port — hostPort used. Fix: expose the pod through a Service. Medium.
• k8s-no-security-context — a container with no securityContext at all. Fix: add the baseline block shown below. Medium.
• k8s-capabilities-not-dropped — capabilities.drop does not include ALL. Fix: drop: [ALL]. Low.
• k8s-writable-root-fs — readOnlyRootFilesystem not true. Fix: set it true and mount an emptyDir where the app writes. Low.
• k8s-automount-token — automountServiceAccountToken not false on the pod. Fix: set it false unless the workload calls the Kubernetes API. Low.
• k8s-seccomp-missing — no seccompProfile on the container or pod, or type Unconfined. Fix: type: RuntimeDefault. Low.

What is a good baseline securityContext for a Kubernetes container?

Set allowPrivilegeEscalation: false, runAsNonRoot: true with a numeric runAsUser, readOnlyRootFilesystem: true, capabilities drop: [ALL] and seccompProfile type RuntimeDefault. Mount an emptyDir for any path the app must write, and add back only the capability the workload demonstrably needs.

Is a hostPath volume to /var/run/docker.sock safe?

No. The Docker API is root on the node: a pod that can reach it can start another container with the node filesystem mounted. Mounting it read-only does not restrict the API. Use a build tool that does not need the daemon, or a socket proxy that exposes only the required endpoints.

Does the default Kubernetes setup run containers as root?

Often yes. If neither the pod nor the container sets runAsNonRoot or runAsUser, the container runs as whatever user the image declares, which is frequently root. allowPrivilegeEscalation also defaults to true. Setting both explicitly removes the guesswork.

Check your own manifests

Paste your YAML into Kubernetes Pod Security Check to see every finding with its line, resource, container, risk and fix, or run the CLI in your own repository:

python3 check.py --fail-on-risk

That exits with a nonzero status on any medium or high finding, so you can wire it into your own CI. Expect some findings to be deliberate (a node agent may truly need hostPath or a capability); review each one.