Pod has no containers with added capabilities

Check ID: core_minimize_containers_added_capabilities
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

What this check verifies

Kubernetes Pods and containers are evaluated for added Linux capabilities via capabilities.add in their security context; presence of added entries indicates elevated privileges beyond defaults.

Risk

Extra capabilities expand the container’s kernel-level permissions, enabling actions like raw socket use, file ownership changes, and mount operations. Compromise could enable node access, lateral movement, or tampering with workloads, impacting confidentiality, integrity, and availability.

Recommendation

Apply least privilege: require containers to drop: ALL and avoid capabilities.add except when strictly justified (e.g., NET_BIND_SERVICE). Enforce with admission policies and separation of duties. Combine with seccomp/AppArmor and non-root execution for defense in depth.

Remediation

CLI
Terraform
Dashboard steps

kubectl patch deployment <example_resource_name> -p '{"spec":{"template":{"spec":{"containers":[{"name":"<example_resource_name>","securityContext":{"capabilities":{"add":[]}}}]}}}}'

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx"
      # Critical: do not set security_context.capabilities.add
      # This ensures no added Linux capabilities, making the check PASS.
    }
  }
}

References

https://kubernetes.io/docs/concepts/security/pod-security-standards/

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_containers_added_capabilities. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Pod does not allow privilege escalation in any container Pod containers add no capabilities and drop defaults

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires