Check ID: core_minimize_admission_windows_hostprocess_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

​
What this check verifies

Kubernetes Pods are evaluated for Windows settings where securityContext.windowsOptions.hostProcess is set to true, indicating they can run Windows HostProcess containers.

​
Risk

Enabling HostProcess grants containers direct access to the Windows node, eroding isolation. Attackers can read node data, tamper with services, capture credentials, and pivot across the cluster, impacting confidentiality, integrity, and availability.

​
Recommendation

Disallow hostProcess:true by default using policy-based admission aligned with Pod Security Standards. Permit only in tightly controlled contexts; apply least privilege, dedicated namespaces, and restricted service accounts; enforce separation of duties and monitor usage.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_container_name>"
      image = "busybox"
      security_context {
        windows_options {
          host_process = false  # critical: disables Windows HostProcess for this container
        }
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_admission_windows_hostprocess_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks