Description

Detects Kubernetes containers that could run with root privileges because `runAsNonRoot` is explicitly disabled in their security context. Running containers as root poses significant security risks as it may allow container processes to gain excessive privileges on the host system if they break out of container isolation.

Detection Strategy

• Examines container specifications in Kubernetes manifests (like Deployments, StatefulSets, etc.)

• Reports a vulnerability if `runAsNonRoot` is explicitly set to false in the container's security context

Vulnerable code example

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  securityContext:
    runAsNonRoot: false  # Vulnerable: Allows pod to run as root
  containers:...

✅ Secure code example

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  automountServiceAccountToken: false  # Prevent access to service account credentials
  securityContext:
    runAsNonRoot: true  # Force pod to run as non-root user...