Back to Checks
kubernetes

Pod does not use the host IPC namespace

core_minimize_hostIPC_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-securitytrust-boundaries
Resource Type:Pod

Kubernetes pods are evaluated for use of the host's IPC namespace via the hostIPC setting. Workloads declaring hostIPC: true share node IPC resources (shared memory, semaphores, message queues) instead of isolated container IPC.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Sharing the host IPC namespace erodes isolation, exposing host shared memory and semaphores. A compromised pod could snoop or tamper with IPC objects, leading to data disclosure, integrity violations, privilege escalation, and lateral movement across workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_hostIPC_containers

Recommendation

Disallow hostIPC with Pod Security Admission enforcing Pod Security Standards (Baseline/Restricted) or equivalent policy engines. Apply least privilege and defense in depth: keep IPC namespaces isolated, grant tightly scoped exceptions only, and prefer app-level messaging or Services over host IPC.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_ipc = false # Critical: disables host IPC namespace to pass the check

    container {
      name  = "app"
      image = "nginx"
    }
  }
}

Other

1Open your cluster UI (Kubernetes Dashboard or cloud provider console) and locate the failing workload (Pod/Deployment/StatefulSet)
2Click Edit YAML/Manifest
3Set the field to disable host IPC:
4- For a Pod: spec.hostIPC: false (or remove hostIPC if present)
5- For controllers: spec.template.spec.hostIPC: false (or remove hostIPC if present)
6Save the change to trigger a rollout
7If it is a standalone Pod (not managed by a controller), delete and recreate the Pod so the new spec takes effect

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_hostIPC_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            if pod.host_ipc:
                report.status = "FAIL"
                report.status_extended = f"Pod {pod.name} is using hostIPC."
            else:
                report.status = "PASS"
                report.status_extended = f"Pod {pod.name} is not using hostIPC."
            findings.append(report)

        return findings

References