Check ID: core_minimize_hostIPC_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security, trust-boundaries
Resource type: Pod

​
What this check verifies

Kubernetes pods are evaluated for use of the host’s IPC namespace via the hostIPC setting. Workloads declaring hostIPC: true share node IPC resources (shared memory, semaphores, message queues) instead of isolated container IPC.

​
Risk

Sharing the host IPC namespace erodes isolation, exposing host shared memory and semaphores. A compromised pod could snoop or tamper with IPC objects, leading to data disclosure, integrity violations, privilege escalation, and lateral movement across workloads.

​
Recommendation

Disallow hostIPC with Pod Security Admission enforcing Pod Security Standards (Baseline/Restricted) or equivalent policy engines. Apply least privilege and defense in depth: keep IPC namespaces isolated, grant tightly scoped exceptions only, and prefer app-level messaging or Services over host IPC.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_ipc = false # Critical: disables host IPC namespace to pass the check

    container {
      name  = "app"
      image = "nginx"
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_hostIPC_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks