Back to Checks
kubernetes

Pod does not run any container as the root user

core_minimize_root_containers_admission
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are assessed for containers configured to run as the root user. The evaluation identifies containers whose security context sets runAsUser: 0.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Containers running as root (UID 0) enable privilege escalation and container breakout. Attackers can modify workloads (integrity), read sensitive data on mounted volumes (confidentiality), and disrupt nodes or services via kernel/daemon abuse (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_root_containers_admission

Recommendation

Require non-root execution and enforce least privilege:

  • Set runAsNonRoot: true and a non-zero runAsUser
  • Use images with a defined non-root UID
  • Apply Pod Security Standards - restricted or policies to block UID 0
  • Use allowPrivilegeEscalation: false and drop unnecessary capabilities

Remediation

CLI

kubectl patch pod <POD_NAME> -n <NAMESPACE> --type=strategic -p '{"spec":{"containers":[{"name":"<CONTAINER_NAME>","securityContext":{"runAsUser":1000}}]}}'

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      security_context {
        run_as_user = 1000  # Critical: set a non-zero UID so the container is not root
      }
    }
  }
}

Other

1In your Kubernetes dashboard or kubectl editor, open the workload (Deployment/StatefulSet/DaemonSet) that created the failing Pod.
2Edit the YAML and set a non-root UID for the specific container:
3```yaml
4spec:
5template:
6spec:
7containers:
8- name: <CONTAINER_NAME>
9securityContext:
10runAsUser: 1000 # Critical: non-zero UID
11```
12Save and apply. Wait for the new Pod to start and verify the finding is resolved.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_root_containers_admission(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} is not running as root user."

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["run_as_user"] == 0
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} is running as root user in container {container.name}."
                    break

            findings.append(report)

        return findings

References