Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features still have a escalated likelihood of container breakout.
Ideally, all containers should run as a defined non-UID 0 user.
There should be at least one admission control policy defined which does not permit root containers.
If you need to run root containers, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.
MutatingWebhookConfiguration, Namespace, ValidatingWebhookConfiguration
Do not generally permit containers to be run as the root user.
List the policies in use for each namespace in the cluster, ensure that each policy restricts the use of root containers by setting
MustRunAs with the range of UIDs not including 0.
Create a policy for each namespace in the cluster, ensuring that either
MustRunAs with the range of UIDs not including 0, is set.
Pods with containers which run as the root user will not be permitted.
By default, there are no restrictions on the use of root containers and if a User is not specified in the image, the container will run as root.
Updated 6 days ago