Back to Checks
kubernetes

Pod does not use the host PID namespace

core_minimize_hostPID_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-securitytrust-boundaries
Resource Type:Pod

Kubernetes Pods configured with hostPID: true are identified, indicating the container shares the node's host PID namespace.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Sharing the host PID namespace erodes isolation: containers can list host processes and read /proc metadata, enabling credential exposure, privilege escalation, and lateral movement. Limited process interaction can also threaten integrity and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_hostPID_containers

Recommendation

Disallow hostPID for application Pods via admission policies aligned to Pod Security Standards (Baseline/Restricted). Allow only for tightly controlled system workloads. Apply least privilege, isolate such Pods on dedicated nodes, and favor debug/observability methods that avoid host namespace sharing.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_pid = false  # Critical: disables host PID namespace to pass the check
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

Other

1Identify the workload that owns the failing Pod (Deployment/DaemonSet/StatefulSet/Job) or confirm it is a standalone Pod
2Edit the manifest of the owning workload (or the Pod) and set/remove the field so it is not true:
3- In Pod spec: set `hostPID: false` or delete the `hostPID` line
4- For controllers: set `spec.template.spec.hostPID: false` or delete the line
5Apply the change (kubectl apply) and allow the workload to restart Pods so they no longer use hostPID

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_hostPID_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            if pod.host_pid:
                report.status = "FAIL"
                report.status_extended = f"Pod {pod.name} is using hostPID."
            else:
                report.status = "PASS"
                report.status_extended = f"Pod {pod.name} is not using hostPID."
            findings.append(report)

        return findings

References