Description

Detects Kubernetes configurations that enable hostPID, which allows containers to share the host's process namespace. This is a security risk as it gives containers visibility into all processes running on the host node and enables potential interference with host processes.

Detection Strategy

• Identifies Kubernetes resource manifests (like Pod, Deployment, etc.) in YAML/JSON format

• Checks for hostPID: true configuration in the pod spec section

• Reports a vulnerability when a container is configured to share the host PID namespace

Vulnerable code example

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  hostPID: true  # SECURITY ISSUE: Allows pod to see all processes on the host node
  containers:
    - name: container...

✅ Secure code example

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  labels:
    app: nginx
spec:
  # Removed hostPID: true to prevent access to host processes...