lacework-global-653
4.2.6 Minimize the execution of container workloads running as the root user (Automated)
Profile Applicability
• Level 2
Description
Do not configure pods to explicitly run containers as the root
user (uid=0).
Rationale
Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features, still have an escalated likelihood of container breakout.
Ideally, all containers should run as a defined non-UID 0 user.
Impact
Pods with containers which run as the root user will not be permitted.
Audit
Get the configuration of all pods using the following command:
kubectl get pods -o json
Inspect the JSON output and ensure that, for each pod in .items[]
, the runAsUser
attribute is non-zero or not set within .spec.securityContext
and .spec.containers[].securityContext
.
If jq
is available in the shell then pods which violate this principle can be found more easily. Run the following command and ensure that the output is an empty array:
kubectl get pods -o json | jq -r '.items[] | select(.spec.securityContext.runAsUser==0 or .spec.containers[].securityContext.runAsUser==0) | {name: .metadata.name}' | jq -s '.'
Remediation
Ensure that pods which configure the runAsUser
attribute use a non-zero value.
This attribute can be set in the security context of a pod or an individual container. Configuring this at a container level will override what is set at a pod level.
The following example explicitly configures the pod to run as a user with uid=1000, with a container configuration override to 1001:
apiVersion: v1
kind: Pod
metadata:
name: my-pod
spec:
securityContext:
runAsUser: 1000
containers:
- name: hello-world
image: hello-world
securityContext:
runAsUser: 1001
If the runAsUser
attribute is not configured then container workloads in the pod will execute as the user specified in the container image metadata. With this in mind, all containers should either be configured appropriately in the pod configuration or have their default user verified as non-root in the image itself.
References
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#securitycontext-v1-core https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#podspec-v1-core