Check ID: core_minimize_privileged_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

​
What this check verifies

Kubernetes Pods are evaluated for containers configured with securityContext.privileged: true, indicating execution in privileged mode.

​
Risk

Privileged containers can control the host and bypass isolation, enabling:
  • Secret theft (confidentiality)
  • Workload/node tampering (integrity)
  • Service disruption (availability) Compromise of one pod can drive lateral movement across the cluster.

​
Recommendation

Block privileged: true using Pod Security Admission at restricted. Apply least privilege:
  • Run unprivileged; set allowPrivilegeEscalation: false
  • Drop capabilities; avoid host access
  • Restrict who can deploy privileged pods with RBAC
  • Use short-lived, audited exceptions only when strictly required

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      security_context {
        privileged = false # Critical: disables privileged mode to pass the check
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_privileged_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks