Why is it unsafe to run containers with root user privileges in Kubernetes?

Running containers with root privileges in Kubernetes poses several security risks:

• Host Privileges: A process inside a container running as root potentially has access to the underlying host operating system and its resources. If the container is compromised, an attacker could gain control over the node.
• Container Escape: Vulnerabilities in the Linux kernel, Docker/containerd, or other software may allow a process running as root inside a container to "escape" the container and execute commands on the host.
• Attack Extension: If a container with root is compromised, an attacker can use these privileges to perform malicious actions within the cluster, such as:
  • Accessing secrets of other pods or the cluster.
  • Modifying cluster configuration.
  • Launching other malicious pods.
• File System Permissions: Processes running as root can ignore access rights to files on mounted volumes, which may lead to modification or deletion of critical data.
• SecComp/AppArmor Bypass: Despite the presence of security profiles (e.g., Seccomp, AppArmor/SELinux), their effectiveness is significantly reduced when processes run as root.
• Implicit Risks: Often, applications do not require root privileges for normal operation. Running as root may hide access or configuration issues that could be detected when running as a non-privileged user.

Recommendations to minimize risks:

• Run containers as a non-privileged user.
• Use SecurityContext in pod manifests:
  • runAsNonRoot: true
  • runAsUser: <uid> (e.g., 1000)
• Limit container capabilities using capabilities.
• Apply Pod Security Policies (PSP/PSA).

Example of using SecurityContext:

# Example pod manifest with SecurityContext
apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
spec:
  containers:
  - name: myapp-container
    image: myapp-image
    securityContext:
      runAsNonRoot: true    # Disallows running as root
      runAsUser: 1000       # Specifies UID
      allowPrivilegeEscalation: false # Disallows privilege escalation
      readOnlyRootFilesystem: true # Mounts root filesystem as read-only
      capabilities:
        drop:
        - ALL # Drops all privileges