Question

A security review of a Kubernetes production cluster finds that several application containers run as the root user and can write to the host filesystem through mounted volumes. A recent penetration test showed that a compromised container could escalate to the underlying node. Which control should the security team prioritize to reduce the impact of a container compromise?

Accepted Answer

Apply a Pod Security policy that enforces runAsNonRoot, a read-only root filesystem, and dropped Linux capabilities

Answer

Enable network policies to restrict east-west traffic between pods in the namespace

Answer

Rotate the container registry credentials and enforce image signing on all deployments

Answer

Increase the CPU and memory resource limits on the affected pods to prevent resource exhaustion