Project: KICS (Provisioning / Security & Compliance)
File: 02323c00-cdc3-4fdc-a310-4f2b3e7a1660.md

title: Container Running With Low UID hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 02323c00-cdc3-4fdc-a310-4f2b3e7a1660 Query name: Container Running With Low UID Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: Check if containers are running with low UID, which might cause conflicts with the host's user table.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" apiVersion: v1 kind: Pod metadata: name: security-context-demo-2 spec: securityContext: runAsUser: 1000 containers: name: sec-ctx-demo-2 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 2000 allowPrivilegeEscalation: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="18 13" apiVersion: v1 kind: Pod metadata: name: security-context-demo-2 spec: securityContext: runAsUser: 10 runAsNonRoot: false containers: name: sec-ctx-demo-100 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 333 runAsNonRoot: false name: sec-ctx-demo-200 image: gcr.io/google-samples/node-hedwfwllo:1.0 securityContext: runAsUser: 340 runAsNonRoot: false ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="12" apiVersion: v1 kind: Pod metadata: name: containers-runs-as-root spec: securityContext: runAsNonRoot: false containers: name: sec-ctx-demo-100 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 13 runAsNonRoot: false ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="18" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 1200 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: readOnlyRootFilesystem: true ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="28 22" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: containers: name: frontend image: nginx ports: containerPort: 80 securityContext: readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: readOnlyRootFilesystem: true ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="32 25" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 12000 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: runAsUser: 1234 readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: runAsUser: 5678 readOnlyRootFilesystem: true ``` </details> <details><summary>Positive test num. 7 - yaml file</summary> ```yaml hl_lines="25 23" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: containers: name: frontend image: nginx ports: containerPort: 80 securityContext: runAsUser: 1234 readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: security-context-demo-2 spec: securityContext: runAsUser: 10000 containers: name: sec-ctx-demo-2 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 10100 allowPrivilegeEscalation: false ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 65532 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: runAsUser: 12000 readOnlyRootFilesystem: true name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: readOnlyRootFilesystem: true ```