# Container privilege review

A checklist for pods, Compose files, and Dockerfiles that run with more privilege than the process needs.

You are looking at a container spec before it lands on a shared cluster or a laptop that mounts the host.

## What you should get

The containers that run as root, mount the Docker socket, or turn on host access, with the line that does it.

## Checklist

- privileged is true, or the container adds SYS_ADMIN, NET_ADMIN, or SYS_PTRACE.
- The Docker socket or another host runtime socket is mounted in.
- The process runs as root, or the image never sets USER.
- hostNetwork, hostPID, or hostIPC is set.
- No memory limit is set on a container that can be driven by outside input.
- A volume mounts a host path that includes credentials, the Docker config, or /.

## Container privilege review

Review the container spec I paste for extra privilege.

Use only the Dockerfile, Compose file, or Kubernetes manifest I give you. If the runtime flags live in another file, ask for that file before you call the container safe.

For each finding:
- Quote the container name and the line.
- Say what the setting lets the process do on the host or the cluster.
- Give one change, such as dropping the capability, setting a user, or removing the mount.
- Say how to confirm the new spec still starts.

Skip formatting. Skip findings you cannot point at in the text.

The HTML page is https://skaleagents.com/resources/container-privilege-review. Use Actions there to copy the prompt or open it in an assistant.