Pod does not run any container as the root user

Check ID: core_minimize_root_containers_admission
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

What this check verifies

Kubernetes Pods are assessed for containers configured to run as the root user. The evaluation identifies containers whose security context sets runAsUser: 0.

Risk

Containers running as root (UID 0) enable privilege escalation and container breakout. Attackers can modify workloads (integrity), read sensitive data on mounted volumes (confidentiality), and disrupt nodes or services via kernel/daemon abuse (availability).

Recommendation

Require non-root execution and enforce least privilege:

Set runAsNonRoot: true and a non-zero runAsUser
Use images with a defined non-root UID
Apply Pod Security Standards - restricted or policies to block UID 0
Use allowPrivilegeEscalation: false and drop unnecessary capabilities

Remediation

CLI
Terraform
Dashboard steps

kubectl patch pod <POD_NAME> -n <NAMESPACE> --type=strategic -p '{"spec":{"containers":[{"name":"<CONTAINER_NAME>","securityContext":{"runAsUser":1000}}]}}'

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      security_context {
        run_as_user = 1000  # Critical: set a non-zero UID so the container is not root
      }
    }
  }
}

In your Kubernetes dashboard or kubectl editor, open the workload (Deployment/StatefulSet/DaemonSet) that created the failing Pod.

Edit the YAML and set a non-root UID for the specific container:

spec:
  template:
    spec:
      containers:
      - name: <CONTAINER_NAME>
        securityContext:
          runAsUser: 1000  # Critical: non-zero UID

Save and apply. Wait for the new Pod to start and verify the finding is resolved.

References

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_root_containers_admission. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Pod does not contain a privileged container Pod does not contain secret environment variables

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires