Back to Checks
kubernetes

Pod does not contain a privileged container

core_minimize_privileged_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are evaluated for containers configured with securityContext.privileged: true, indicating execution in privileged mode.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Privileged containers can control the host and bypass isolation, enabling:

  • Secret theft (confidentiality)
  • Workload/node tampering (integrity)
  • Service disruption (availability) Compromise of one pod can drive lateral movement across the cluster.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_privileged_containers

Recommendation

Block privileged: true using Pod Security Admission at restricted. Apply least privilege:

  • Run unprivileged; set allowPrivilegeEscalation: false
  • Drop capabilities; avoid host access
  • Restrict who can deploy privileged pods with RBAC
  • Use short-lived, audited exceptions only when strictly required

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      security_context {
        privileged = false # Critical: disables privileged mode to pass the check
      }
    }
  }
}

Other

1Open your Kubernetes UI (e.g., cloud provider console or Dashboard)
2Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest
3Set securityContext.privileged: false for each affected container:
4- For controllers: spec.template.spec.containers[].securityContext.privileged: false
5- For standalone Pods: spec.containers[].securityContext.privileged: false
6Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_privileged_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} does not contain a privileged container."
            )

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["privileged"]
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} contains a privileged container {container.name}."
                    break

            findings.append(report)

        return findings

References