Description

Identifies Kubernetes configurations that allow containers to run as root user (privileged mode). Running containers with root privileges poses security risks as compromised containers could gain extensive access to the host system and other containers.

Detection Strategy

• Scan Kubernetes resource configuration files (Deployments, Pods, etc)

• Check container specifications for security context settings

• Report a vulnerability if 'runAsNonRoot' is set to false or missing in the container security context

• Consider containers in Pod templates within higher-level resources like Deployments and StatefulSets

Vulnerable code example

resource "kubernetes_pod_v1" "vulnerable_pod" {
  metadata {
    name = "vulnerable-pod"
  }
  spec {
    # Vulnerable: Pod-level security context allows running as root
    security_context {
      run_as_non_root = false...

✅ Secure code example

resource "kubernetes_pod_v1" "secure_pod" {
  metadata {
    name = "secure-pod"
  }
  spec {
    # Pod-level security context prevents root execution for all containers
    security_context {
      run_as_non_root = true...