Check ID: core_minimize_hostPID_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security, trust-boundaries
Resource type: Pod

​
What this check verifies

Kubernetes Pods configured with hostPID: true are identified, indicating the container shares the node’s host PID namespace.

​
Risk

Sharing the host PID namespace erodes isolation: containers can list host processes and read /proc metadata, enabling credential exposure, privilege escalation, and lateral movement. Limited process interaction can also threaten integrity and availability.

​
Recommendation

Disallow hostPID for application Pods via admission policies aligned to Pod Security Standards (Baseline/Restricted). Allow only for tightly controlled system workloads. Apply least privilege, isolate such Pods on dedicated nodes, and favor debug/observability methods that avoid host namespace sharing.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_pid = false  # Critical: disables host PID namespace to pass the check
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_hostPID_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks