lacework-global-653
Minimize the execution of container workloads running as the root user (Automated)
Profile Applicability
• Level 2
Description
Do not configure pods to explicitly run containers as the root user (uid=0).
Rationale
Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features, still have an escalated likelihood of container breakout.
Ideally, all containers should run as a defined non-UID 0 user.
Impact
Pods with containers which run as the root user will not be permitted.
Audit
Get the configuration of all pods using the following command:
kubectl get pods -o json
Inspect the JSON output and ensure that, for each pod in .items[]
, the runAsUser
attribute is non-zero or not set within .spec.securityContext
and .spec.containers[].securityContext
.
If jq
is available in the shell then pods which violate this principle can be found more easily. Run the following command and ensure that the output is an empty array:
kubectl get pods -o json | jq -r '.items[] | select(.spec.securityContext.runAsUser==0 or .spec.containers[].securityContext.runAsUser==0) | {name: .metadata.name}' | jq -s '.'
Remediation
Ensure that pods which configure the runAsUser attribute use a non-zero value.
You can set this attribute in the security context of a pod or an individual container. Configuring this at a container level overrides the pod level setting.
The following example explicitly configures the pod to run as a user with uid=1000, with a container configuration override to 1001:
apiVersion: v1
kind: Pod
metadata:
name: example-pod
spec:
securityContext:
runAsUser: 1000
containers:
- name: hello-world
image: hello-world
securityContext:
runAsUser: 1001
If the runAsUser attribute is not configured then container workloads in the pod execute as the user specified in the container image metadata. With this in mind, configure all containers appropriately in the pod configuration or have their default user verified as non-root in the image itself.
References
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#securitycontext-v1-core
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#podspec-v1-core