Minimize Admission of Root Containers (CIS 5.2.7)

Impact & Risk Analysis

Severity: Medium (Level 2 - Defense in Depth)
CIS Benchmark: CIS 5.2.7
Impact: Container Breakout. Containers running as root (UID 0), even if restricted by namespaces, present a higher risk. If a vulnerability exists in the container runtime or kernel, a process already running as root has a much easier path to escaping the container and gaining control of the host than a process running as an unprivileged user.

Common Misconfiguration

Deploying containers using default images (like node:latest or nginx:latest) without specifying a user. By default, most Docker images run as root unless the Dockerfile explicitly creates a user or the Kubernetes manifest overrides it.

Vulnerable Example

# Vulnerable Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: root-running-pod
spec:
  containers:
  - name: app
    image: nginx:latest
    # VULNERABLE: No securityContext defined.
    # Nginx image runs as root by default.

Secure Example

# Secure Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: non-root-pod
spec:
  securityContext:
    # SECURE: Kubelet will refuse to start this pod if it tries to run as UID 0
    runAsNonRoot: true
    # SECURE: Explicitly define a non-zero UID (e.g., 1000)
    runAsUser: 1000
    runAsGroup: 3000
  containers:
  - name: app
    image: my-secure-app:latest

Audit Procedure

List the policies in use for each namespace and audit the pods to ensure they are not running as root. Check Running Pods:

# Check if pods are explicitly configured to run as non-root
kubectl get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.securityContext.runAsNonRoot}\n{end}'

Check Policies: Verify if the namespace enforces the restricted Pod Security Standard.

kubectl get ns --show-labels

Pass: If the label pod-security.kubernetes.io/enforce=restricted is present.
Fail: If the label is baseline or privileged (both allow running as root).

Remediation

Update Application Manifests: Modify your Deployment YAMLs to include runAsNonRoot: true and specify a runAsUser > 0.
Enforce Policy: Apply the restricted Pod Security Standard to your namespaces.

# Enforce the restricted policy (blocks root containers)
kubectl label --overwrite ns default pod-security.kubernetes.io/enforce=restricted

Getting Started

Product Guides

Integrations

Supported Languages

Vulnerability Reference

Security & Trust

User Management

Minimize Admission of Root Containers (CIS 5.2.7)

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation

​Impact & Risk Analysis

​Common Misconfiguration

​Vulnerable Example

​Secure Example

​Audit Procedure

​Remediation

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation