Pod containers add no capabilities and drop defaults

Check ID: core_minimize_containers_capabilities_assigned
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

What this check verifies

Kubernetes Pods are inspected for container Linux capabilities. A finding occurs when any container sets capabilities in add or does not fully drop them (e.g., missing ALL), indicating capabilities are assigned instead of removed.

Risk

Retained or added Linux capabilities enable privilege escalation and container escape.

Confidentiality: packet capture and secret access
Integrity: filesystem mounts or process tampering
Availability: killing services or altering networking

Recommendation

Apply least privilege: drop ALL capabilities and avoid using add. Only reintroduce a minimal capability when absolutely required, and isolate such pods via defense-in-depth: strict RBAC, seccomp RuntimeDefault, AppArmor, network policies, dedicated namespaces/nodes, and admission controls to enforce policy.

Remediation

CLI
Terraform
Dashboard steps

kubectl patch deployment <DEPLOYMENT_NAME> -n <NAMESPACE> --type=merge -p '{"spec":{"template":{"spec":{"containers":[{"name":"<CONTAINER_NAME>","securityContext":{"capabilities":{"drop":["ALL"],"add":[]}}}]}}}}'

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx:stable-alpine"
      security_context {
        capabilities {
          drop = ["ALL"] # Critical: drop all Linux capabilities to satisfy the check
          # No 'add' specified to ensure no capabilities are added
        }
      }
    }
  }
}

References

https://kubernetes.io/docs/concepts/security/pod-security-standards/

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_containers_capabilities_assigned. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Pod has no containers with added capabilities Pod does not use the host IPC namespace

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires