Back to Checks
kubernetes

Container memory limits are configured

core_memory_limits_set
Service: coreSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are evaluated for containers without memory limits configured in resources.limits.memory, indicating unbounded memory consumption is permitted.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without memory limits, a single container can consume all available node memory, causing:

  • OOM kills of other workloads (availability)
  • Node instability and cascading failures
  • Noisy-neighbor problems in multi-tenant clusters Attackers exploiting a vulnerability can amplify impact by exhausting node resources, enabling denial of service across co-located workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_memory_limits_set

Recommendation

Set memory limits on every container to prevent unbounded consumption and protect node stability.

  • Start with observed usage plus headroom; tune with VPA recommendations
  • Combine with LimitRanges and ResourceQuotas at the namespace level for defense in depth
  • Monitor memory usage and OOMKill events to right-size limits over time

Remediation

CLI

kubectl set resources deployment/<workload-name> -c <container-name> --limits=memory=<memory-limit> -n <namespace>
# Example: kubectl set resources deployment/nginx -c nginx --limits=memory=128Mi -n default

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      resources {
        limits = {
          memory = "128Mi" # Critical: sets a memory ceiling to prevent unbounded consumption
        }
      }
    }
  }
}

Other

1Open your Kubernetes UI (e.g., cloud provider console or Dashboard)
2Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest
3Set resources.limits.memory for each affected container:
4- For controllers: spec.template.spec.containers[].resources.limits.memory
5- For standalone Pods: spec.containers[].resources.limits.memory
6Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_memory_limits_set(Check):
    """Ensure that memory limits are set on all containers."""

    def execute(self) -> list[Check_Report_Kubernetes]:
        """Execute the check logic.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} has memory limits set on all containers."
            )

            for container in (pod.containers or {}).values():
                resources = container.resources or {}
                limits = (
                    resources.get("limits") if isinstance(resources, dict) else None
                )
                memory = (
                    limits.get("memory")
                    if limits and isinstance(limits, dict)
                    else None
                )
                if not memory:
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} does not have memory limits set on container {container.name}."
                    break

            findings.append(report)

        return findings

References