Back to Checks
kubernetes

Pod does not allow Windows HostProcess containers

core_minimize_admission_windows_hostprocess_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are evaluated for Windows settings where securityContext.windowsOptions.hostProcess is set to true, indicating they can run Windows HostProcess containers.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Enabling HostProcess grants containers direct access to the Windows node, eroding isolation. Attackers can read node data, tamper with services, capture credentials, and pivot across the cluster, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_admission_windows_hostprocess_containers

Recommendation

Disallow hostProcess:true by default using policy-based admission aligned with Pod Security Standards. Permit only in tightly controlled contexts; apply least privilege, dedicated namespaces, and restricted service accounts; enforce separation of duties and monitor usage.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_container_name>"
      image = "busybox"
      security_context {
        windows_options {
          host_process = false  # critical: disables Windows HostProcess for this container
        }
      }
    }
  }
}

Other

1Open your Kubernetes GUI (for example, Kubernetes Dashboard)
2Go to Workloads > Deployments/DaemonSets/StatefulSets (edit the owner of the Pod, not the Pod itself)
3Select the workload that creates the failing Pod and click Edit
4For each affected container, set: securityContext.windowsOptions.hostProcess to false (or remove the hostProcess field)
5Save the change to trigger a rollout; new Pods will be created without HostProcess
6Verify new Pods no longer contain securityContext.windowsOptions.hostProcess: true

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_admission_windows_hostprocess_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} does not have the ability to run a Windows HostProcess."

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["windows_options"]
                    and container.security_context["windows_options"]["host_process"]
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} has the ability to run a Windows HostProcess in container {container.name}."
                    break

            findings.append(report)

        return findings

References