Skip to main content

lacework-global-651

4.2.4 Minimize the execution of container workloads sharing the host network namespace (Automated)

Profile Applicability

• Level 1

Description

Do not generally permit containers to be run with the hostNetwork flag set to true.

Rationale

A container running in the host's network namespace could access the local loopback device, and could access network traffic to and from other pods.

Impact

Pods defined with spec.hostNetwork: true will not be permitted.

Audit

The following command returns pods which have the spec.hostNetwork flag set to true.

Run the command and verify that it does not return any pods:

kubectl get pods -o jsonpath="{range.items[?(@.spec.hostNetwork==true)]}{.metadata.name}{'\n'}{end}"

Remediation

Update pod configurations to ensure that the spec.hostNetwork flag is false or not set (will default to false if not set).

The following example explicitly sets the hostNetwork flag to false:

apiVersion: v1
kind: Pod
metadata:
name: my-pod
spec:
hostNetwork: false
containers:
- name: hello-world
image: hello-world

References

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#podspec-v1-core https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod