fix: run web container as non-root and disable privilege escalation - #118
Open
hacktron-app-stg[bot] wants to merge 1 commit into
Open
fix: run web container as non-root and disable privilege escalation#118hacktron-app-stg[bot] wants to merge 1 commit into
hacktron-app-stg[bot] wants to merge 1 commit into
Conversation
The web Deployment ran as root (runAsUser: 0) and allowed privilege escalation, increasing the impact of any in-container code execution. Set runAsNonRoot: true, runAsUser: 1000, and allowPrivilegeEscalation: false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
deployment.yamlruns thewebcontainer as the root user and permits privilege escalation:Running as root (UID 0) combined with
allowPrivilegeEscalation: truemeans that if an attacker gains code execution inside the container, they already have root and can further escalate via setuid binaries — significantly increasing blast radius.Fix
Harden the container
securityContext:runAsNonRoot: truemakes the kubelet refuse to start the pod if the image would otherwise run as UID 0, providing defense in depth.runAsUser: 1000picks a non-root UID.allowPrivilegeEscalation: falsesetsNoNewPrivson the process, blocking setuid-based escalation.The change is limited to the lines flagged in the finding. Unrelated hardening issues in the same manifest (privileged container, host namespaces, hardcoded secret, host-root mount, mutable image tag) are tracked as separate findings and left unchanged to keep this PR minimal and reviewable.
Verification
deployment.yaml:25-26at the checked-out commit.securityContext).Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/ccae1384-92bc-49e4-ae51-a45c12b298f2