Kubernetes workload runs as root (ARCH10023)

Key config.k8s.runs-as-root · Severity warning · Category security · CWE CWE-250

A manifest that asks for root, or explicitly allows it, makes every container escape and every writable host path worth more. Pod and container securityContext are both read.

Incorrect

apiVersion: apps/v1
kind: Deployment
metadata:
  name: worker
spec:
  selector:
    matchLabels:
      app: worker
  template:
    metadata:
      labels:
        app: worker
    spec:
      securityContext:
        runAsUser: 0
      containers:
        - name: worker
          image: example/worker:1.9.0

Correct

apiVersion: apps/v1
kind: Deployment
metadata:
  name: worker
spec:
  selector:
    matchLabels:
      app: worker
  template:
    metadata:
      labels:
        app: worker
    spec:
      securityContext:
        runAsUser: 10001
        runAsNonRoot: true
      containers:
        - name: worker
          image: example/worker:1.9.0

Fix

Run as a non-root user: runAsUser above 0 and runAsNonRoot: true.

Not flagged

• A manifest that says nothing about the user: the container then runs as the image’s user, which the manifest cannot show (see ARCH10001 for the image).