Question

A security review of your team's Kubernetes workloads finds that several containers run as the root user (UID 0) inside their images. Your security lead asks you to reduce the risk that a compromised container could escalate privileges on the host. Which change to the Pod specification most directly addresses this concern as a container security basic?

Accepted Answer

Set securityContext.runAsNonRoot to true (and specify a non-zero runAsUser) so the container is prevented from running as root

Answer

Add a NetworkPolicy that denies all ingress traffic to the affected Pods

Answer

Increase the container's CPU and memory limits to constrain resource abuse

Answer

Change the Service type from LoadBalancer to ClusterIP to reduce external exposure