Kubernetes container runs in privileged mode

Description

Privileged containers receive broad permissions and weaken normal container isolation. Ordinary applications should use only the permissions they need; apply the same review to init containers.

Privileged mode is distinct from running as UID 0. Its actual effects on a node also depend on device access, mounts and other security settings.

Potential impact

A compromised container may affect node resources and other workloads.
Broad device and kernel access can be abused.

Remediation

Set privileged = false in the container’s security_context block.
Reduce the required features and scope of workloads that need special privileges, and isolate them with dedicated nodes and policies.
Review capabilities, hostPath volumes and shared host namespaces too.

Examples

The examples compare privileged settings. The image version is historical; choose a supported image for deployment.

Before

hcl

resource "kubernetes_pod" "app_pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    container {
      image = "nginx:1.7.9"
      name  = "app-container"

      security_context {
        privileged = true
      }
    }
  }
}

The container runs in privileged mode, weakening its isolation.

After

hcl

resource "kubernetes_pod" "app_pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    container {
      image = "nginx:1.7.9"
      name  = "app-container"

      security_context {
        privileged = false
      }
    }
  }
}

Privileged mode is disabled. Other permissions and host-access settings still need restriction.