Skip to main content

lacework-global-653

4.2.6 Minimize the execution of container workloads running as the root user (Automated)​

Profile Applicability​

• Level 2

Description​

Do not configure pods to explicitly run containers as the root user (uid=0).

Rationale​

Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features, still have an escalated likelihood of container breakout.

Ideally, all containers should run as a defined non-UID 0 user.

Impact​

Pods with containers which run as the root user will not be permitted.

Audit​

Get the configuration of all pods using the following command:

kubectl get pods -o json

Inspect the JSON output and ensure that, for each pod in .items[], the runAsUser attribute is non-zero or not set within .spec.securityContext and .spec.containers[].securityContext.

If jq is available in the shell then pods which violate this principle can be found more easily. Run the following command and ensure that the output is an empty array:

kubectl get pods -o json | jq -r '.items[] | select(.spec.securityContext.runAsUser==0 or .spec.containers[].securityContext.runAsUser==0) | {name: .metadata.name}' | jq -s '.'

Remediation​

Ensure that pods which configure the runAsUser attribute use a non-zero value.

You can set this attribute in the security context of a pod or an individual container. Configuring this at a container level overrides the pod level setting.

The following example explicitly configures the pod to run as a user with uid=1000, with a container configuration override to 1001:

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  securityContext:
    runAsUser: 1000
  containers:
  - name: hello-world
    image: hello-world
    securityContext:
      runAsUser: 1001

If the runAsUser attribute is not configured then container workloads in the pod execute as the user specified in the container image metadata. With this in mind, configure all containers appropriately in the pod configuration or have their default user verified as non-root in the image itself.

References​

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#securitycontext-v1-core
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#podspec-v1-core

Last updated on