SkaleAgents

Free resource / No account required

Container privilege review

A checklist for pods, Compose files, and Dockerfiles that run with more privilege than the process needs.

You are looking at a container spec before it lands on a shared cluster or a laptop that mounts the host.

What you should get

The containers that run as root, mount the Docker socket, or turn on host access, with the line that does it.

Checklist

  • privileged is true, or the container adds SYS_ADMIN, NET_ADMIN, or SYS_PTRACE.
  • The Docker socket or another host runtime socket is mounted in.
  • The process runs as root, or the image never sets USER.
  • hostNetwork, hostPID, or hostIPC is set.
  • No memory limit is set on a container that can be driven by outside input.
  • A volume mounts a host path that includes credentials, the Docker config, or /.

Container privilege review

Review the container spec I paste for extra privilege.

Use only the Dockerfile, Compose file, or Kubernetes manifest I give you. If the runtime flags live in another file, ask for that file before you call the container safe.

For each finding:
- Quote the container name and the line.
- Say what the setting lets the process do on the host or the cluster.
- Give one change, such as dropping the capability, setting a user, or removing the mount.
- Say how to confirm the new spec still starts.

Skip formatting. Skip findings you cannot point at in the text.

All free resourcesPrompt library. Reading this page does not submit your infrastructure.