Container is allowed to run as the root user

run_as_non_root

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Vendor

Kubernetes

Resource

General Security

Description

The runAsNonRoot security context setting forces a container to run with a non-root (non-zero) user id. When it is not set to true, Kubernetes allows the container to start as root, so a compromised process runs with root privileges inside the container and has a larger attack surface against the host and the cluster.

runAsNonRoot may be declared at the pod level (spec.securityContext) or per container (spec.containers[].securityContext and initContainers). A container is protected when its own security context sets runAsNonRoot: true, or when it does not override the value and the pod security context sets it to true. This detector reports a resource when at least one of its containers is left able to run as root -either because runAsNonRoot is absent or explicitly false.

This maps to CWE-250 (Execution with Unnecessary Privileges).

We recommend you set runAsNonRoot to true to prevent containers from running with root privileges.

Learn more about this topic at Set security context for a Container.

Examples

apiVersion: v1
kind: Pod
metadata:
  name: insecure
spec:
  containers: (1)
  - name: insecure-container
    image: <image>

1	Leaving `runAsNonRoot` unset (or setting it to `true`) at neither the pod nor the container level lets the container run as the root user.

Mitigation / Fix

apiVersion: v1
kind: Pod
metadata:
  name: secure
spec:
  containers:
    - name: secure-container
      image: <container-image>
      securityContext:
        runAsNonRoot: true (1)

1	Setting `runAsNonRoot` to true forces the container to run with a non-root user, reducing its privileges. It may also be set once at the pod level under `spec.securityContext`.