Check provider logo

Pod does not run any container as the root user

core_minimize_root_containers_admission

Severityhigh
Servicecore
by Prowler
container-security

Kubernetes Pods are assessed for containers configured to run as the root user. The evaluation identifies containers whose security context sets runAsUser: 0.

Risk

Containers running as root (UID 0) enable privilege escalation and container breakout. Attackers can modify workloads (integrity), read sensitive data on mounted volumes (confidentiality), and disrupt nodes or services via kernel/daemon abuse (availability).

Run this check with Prowler CLI

prowler kubernetes --checks core_minimize_root_containers_admission

Run in Prowler Cloud

Recommendation

Require non-root execution and enforce least privilege:

  • Set runAsNonRoot: true and a non-zero runAsUser
  • Use images with a defined non-root UID
  • Apply Pod Security Standards - restricted or policies to block UID 0
  • Use allowPrivilegeEscalation: false and drop unnecessary capabilities

Remediation

CLI

kubectl patch pod <POD_NAME> -n <NAMESPACE> --type=strategic -p '{"spec":{"containers":[{"name":"<CONTAINER_NAME>","securityContext":{"runAsUser":1000}}]}}'

Terraform
Other
  1. In your Kubernetes dashboard or kubectl editor, open the workload (Deployment/StatefulSet/DaemonSet) that created the failing Pod.
  2. Edit the YAML and set a non-root UID for the specific container: 
    spec:
  template:
    spec:
      containers:
      - name: <CONTAINER_NAME>
        securityContext:
          runAsUser: 1000  # Critical: non-zero UID
  3. Save and apply. Wait for the new Pod to start and verify the finding is resolved.

Source Code

Resource Type

Pod

References