Back to Checks
kubernetes

Pod has no containers with added capabilities

core_minimize_containers_added_capabilities
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods and containers are evaluated for added Linux capabilities via capabilities.add in their security context; presence of added entries indicates elevated privileges beyond defaults.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Extra capabilities expand the container's kernel-level permissions, enabling actions like raw socket use, file ownership changes, and mount operations. Compromise could enable node access, lateral movement, or tampering with workloads, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_containers_added_capabilities

Recommendation

Apply least privilege: require containers to drop: ALL and avoid capabilities.add except when strictly justified (e.g., NET_BIND_SERVICE). Enforce with admission policies and separation of duties. Combine with seccomp/AppArmor and non-root execution for defense in depth.

Remediation

CLI

kubectl patch deployment <example_resource_name> -p '{"spec":{"template":{"spec":{"containers":[{"name":"<example_resource_name>","securityContext":{"capabilities":{"add":[]}}}]}}}}'

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx"
      # Critical: do not set security_context.capabilities.add
      # This ensures no added Linux capabilities, making the check PASS.
    }
  }
}

Other

1Open the manifest for the workload creating the Pod (e.g., Deployment/StatefulSet/DaemonSet)
2In spec.template.spec.containers[*].securityContext.capabilities, delete all 'add' entries (remove the entire 'add' list)
3Save and apply the change (kubectl apply or use your GitOps pipeline); the controller will roll out updated Pods
4If it is a standalone Pod, delete and recreate it without the capabilities.add field

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_containers_added_capabilities(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} does not have added capabilities."

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["capabilities"]
                    and container.security_context["capabilities"]["add"]
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} has added capabilities in container {container.name}."
                    break

            findings.append(report)

        return findings

References