Q5: Why is running containers as root a major security vulnerability, and how do you secure container runtime privileges? - DevOps & Kubernetes (50 Qs)

Security Threat Model

By default, UID 0 inside a container is UID 0 on the host kernel unless Linux User Namespaces are enabled. If an attacker achieves Remote Code Execution (RCE) inside a container running as root:

They can exploit kernel vulnerabilities (e.g., Dirty COW, CVE-2024-21626 runc breakout) to break out directly onto the host as host root.
They can access mounted host sockets (e.g., /var/run/docker.sock), granting them uninhibited control over the entire cluster.
They can modify host device nodes and alter sensitive host filesystems.

scss

+-----------------------------------------------------------+
| Host Kernel (UID 0: Root)                                 |
|                                                           |
|   +-----------------------+     +-----------------------+ |
|   | Container A (UNSAFE)  |     | Container B (SECURE)  | |
|   | USER root (UID 0)     |     | USER nonroot (UID 10001)|
|   | ALL Capabilities      |     | Drops ALL Caps        | |
|   | Read-Write Root FS    |     | Read-Only Root FS     | |
|   +-----------------------+     +-----------------------+ |
+-----------------------------------------------------------+

Defensive Hardening Blueprint (Kubernetes SecurityContext)

yaml

apiVersion: v1
kind: Pod
metadata:
  name: hardened-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: api
      image: registry.example.com/api:v1.2.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
  volumes:
    - name: tmp-volume
      emptyDir: {}

Key Defense In Depth Layers

allowPrivilegeEscalation: false: Prevents setuid binaries (e.g., sudo) from elevating privileges.
readOnlyRootFilesystem: true: Blocks attackers from downloading or writing rootkits/malware to the disk; only explicit tmpfs or emptyDir mounts are writable.
capabilities.drop: ["ALL"]: Strips all 40+ Linux capabilities (CAP_NET_ADMIN, CAP_SYS_ADMIN, CAP_SYS_PTRACE), preventing low-level kernel and network tampering.