Containers Should Not Run In Privileged Mode

Manual Steps

Identify all privileged containers (any machine with kubectl access)

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | ((.spec.containers // []) + (.spec.initContainers // []))[]
  | (.securityContext.privileged // false) as $priv
  | select($priv == true)
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + " container=\(.name) image=\(.image) privileged=\($priv)"
    + " is_compliant=false"
  ][]'

Determine the owning workload for each offending pod (any machine with kubectl access)
For a specific pod from the list (replace placeholders with actual values from step 1):
NAMESPACE="example-namespace" POD="example-pod" kubectl get pod "$POD" -n "$NAMESPACE" -o jsonpath='{.metadata.ownerReferences}'
- If there is an ownerReference (Deployment, StatefulSet, DaemonSet, Job, etc.), plan to edit that controller.
- If there is no ownerReference, the pod is standalone; edit or recreate that Pod manifest.
Edit the controller or pod manifest to remove privileged and optionally add specific capabilities (any machine with kubectl access)
a) For a Deployment (similar for StatefulSet/DaemonSet/Job, adjust kind):
kubectl -n example-namespace edit deployment example-deployment
In the opened manifest, for each affected container (including any initContainers):
- Locate and remove or change:
  securityContext: privileged: true
- If the workload needs specific kernel capabilities, replace with only those capabilities, for example:
  securityContext: privileged: false capabilities: add: - NET_ADMIN - SYS_TIME
b) For a standalone Pod (not recommended for long-lived workloads but sometimes present):
kubectl -n example-namespace get pod example-pod -o yaml > /tmp/example-pod.yaml
Edit /tmp/example-pod.yaml and, for each offending container, remove securityContext.privileged: true and optionally add minimal required capabilities as above. Then recreate (pods themselves are immutable):
kubectl -n example-namespace delete pod example-pod kubectl -n example-namespace apply -f /tmp/example-pod.yaml

For Helm-managed workloads, update values instead of live-editing (any machine with kubectl and helm access)

Identify Helm release and chart:

kubectl -n example-namespace get pod example-pod -o jsonpath='{.metadata.labels.helm\.sh/release}'

Fetch current values, update to remove any privileged: true setting and replace with a minimal securityContext.capabilities.add block if needed:

helm -n example-namespace get values example-release > /tmp/example-release-values.yaml
# Edit /tmp/example-release-values.yaml to remove privileged: true and add only necessary capabilities
helm -n example-namespace upgrade example-release example-chart-repo/example-chart \
  -f /tmp/example-release-values.yaml

For workloads that genuinely require broad host interaction, review design instead of defaulting to privileged (any machine with kubectl access)
- Inspect container permissions and behavior to see what it actually needs:
  kubectl -n example-namespace exec -it example-pod -c example-container -- id kubectl -n example-namespace exec -it example-pod -c example-container -- capsh --print || true
- Prefer combinations of:
  - Specific securityContext.capabilities.add entries.
  - hostPath volumes with tight path and readOnly: true where possible.
  - runAsNonRoot: true, readOnlyRootFilesystem: true when compatible.
    Only retain privileged mode if a documented, risk-accepted exception is granted.

Verify no remaining privileged containers (any machine with kubectl access)

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | ((.spec.containers // []) + (.spec.initContainers // []))[]
  | (.securityContext.privileged // false) as $priv
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + " container=\(.name) image=\(.image) privileged=\($priv)"
    + " is_compliant=\(if $priv then "false" else "true" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Confirm that either the output is exactly is_compliant=true or that all listed lines end with privileged=false is_compliant=true.

Using kubectl

On any machine with kubectl access:

Identify the offending pod and its controller

Use the audit output line for the failing pod to see the owner= field. Example:

kind=Pod ns=app-namespace name=app-pod-123 ... owner=Deployment/app-namespace/app-deploy/...

If owner= is present, you must edit that owner (Deployment, StatefulSet, DaemonSet, Job, CronJob). If there is no owner, edit the Pod manifest directly (or the Git/IaC source that owns it).

Export the current manifest for the owner

Example for a Deployment:

kubectl -n app-namespace get deploy app-deploy -o yaml > app-deploy.yaml

(StatefulSet: get statefulset, DaemonSet: get daemonset, Job: get job, CronJob: get cronjob. For an unmanaged Pod: get pod.)

Edit the manifest to remove privileged and, if needed, add fine-grained capabilities

Open the file and, for every affected container (including initContainers), remove the privileged: true setting under securityContext. Optionally add only the specific capabilities required.Example patch inside the Deployment spec:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deploy
  namespace: app-namespace
spec:
  template:
    spec:
      containers:
        - name: app-container
          image: myregistry.azurecr.io/app:1.0
          securityContext:
            # REMOVE this line:
            # privileged: true
            # OPTIONAL: replace with only required capabilities:
            capabilities:
              add:
                - NET_ADMIN
                - SYS_TIME
      initContainers:
        - name: init-sidecar
          image: myregistry.azurecr.io/init:1.0
          securityContext:
            # REMOVE this line:
            # privileged: true
            capabilities:
              add:
                - NET_RAW

Ensure there is no remaining privileged: true under any containers or initContainers.

Apply the updated manifest

kubectl apply -f app-deploy.yaml

For an unmanaged Pod:

kubectl delete -n app-namespace pod app-pod-123
kubectl apply -f app-pod.yaml

(Deleting and recreating is required because Pods are immutable.)

Verification

After the controllers have recreated pods, re-run the audit from any machine with kubectl access:

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | ((.spec.containers // []) + (.spec.initContainers // []))[]
  | (.securityContext.privileged // false) as $priv
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + " container=\(.name) image=\(.image) privileged=\($priv)"
    + " is_compliant=\(if $priv then "false" else "true" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Confirm that all listed containers show privileged=false and the final output is is_compliant=true.

Automation

#!/usr/bin/env bash
set -euo pipefail

# Remediation for: Containers Should Not Run In Privileged Mode (CBP C1.1)
# Scope: Any machine with kubectl access to the AKS cluster
# Requirement: kubectl, jq, and yq (v4, https://github.com/mikefarah/yq) installed and in PATH

# This script:
# 1. Finds all pods (excluding system namespaces) with privileged containers.
# 2. Identifies the owning workload (Deployment/DaemonSet/StatefulSet/Job/CronJob) where possible.
# 3. Patches those workloads to remove securityContext.privileged=true from containers and initContainers.
# 4. Prints manual follow-up for pods that cannot be auto-fixed (e.g., bare Pods).
# 5. Re-runs the audit command to verify.

# ----- config -----
WORK_DIR="$(pwd)/privileged-remediation-$(date +%Y%m%d-%H%M%S)"
mkdir -p "${WORK_DIR}"

echo "Working directory: ${WORK_DIR}"

# ----- helper: run audit and capture list of offending pods -----
echo "Discovering pods with privileged containers..."
AUDIT_JSON="${WORK_DIR}/pods.json"
kubectl get pods --all-namespaces -o json > "${AUDIT_JSON}"

# Build a JSON list of offending containers with ownership data
OFFENDERS_JSON="${WORK_DIR}/offenders.json"
jq '
  .items[]
  | select(.metadata.namespace as $n
           | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | [ ($m.ownerReferences // [])[] | select(.controller) ] | first as $own
  | (.spec.containers // [] + .spec.initContainers // [])[]
  | select((.securityContext.privileged // false) == true)
  | {
      podNamespace: $m.namespace,
      podName: $m.name,
      containerName: .name,
      ownerKind: ($own.kind // null),
      ownerName: ($own.name // null)
    }
' "${AUDIT_JSON}" | jq -s '.' > "${OFFENDERS_JSON}"

if [[ "$(jq 'length' "${OFFENDERS_JSON}")" -eq 0 ]]; then
  echo "No privileged containers found outside system namespaces. Cluster is compliant."
  exit 0
fi

echo "Found $(jq 'length' "${OFFENDERS_JSON}") privileged container entries. Beginning remediation..."

# ----- function: patch a specific workload to remove privileged -----
patch_workload() {
  local ns="$1"
  local kind="$2"
  local name="$3"

  local base="${WORK_DIR}/${ns}-${kind}-${name}"
  local orig_yaml="${base}-orig.yaml"
  local patched_yaml="${base}-patched.yaml"

  # Retrieve the workload manifest
  if ! kubectl get "${kind}" "${name}" -n "${ns}" -o yaml > "${orig_yaml}" 2>/dev/null; then
    echo "WARN: Failed to get ${kind}/${ns}/${name}; skipping."
    return
  fi

  cp "${orig_yaml}" "${patched_yaml}"

  # Remove .securityContext.privileged from all containers and initContainers
  # in .spec.template.spec (covers Deployments, DS, SS, Jobs, CronJobs)
  yq eval '
    (.. | select(has("containers")).containers[]? // {}) |= (
      .securityContext |= ( . // {} | with(.privileged; . = null) | with_entries(select(.value != null)))
    ) |
    (.. | select(has("initContainers")).initContainers[]? // {}) |= (
      .securityContext |= ( . // {} | with(.privileged; . = null) | with_entries(select(.value != null)))
    )
  ' "${patched_yaml}" > "${patched_yaml}.tmp" && mv "${patched_yaml}.tmp" "${patched_yaml}"

  # If no change, skip apply
  if diff -q "${orig_yaml}" "${patched_yaml}" >/dev/null; then
    echo "No privileged fields found in ${kind}/${ns}/${name}; nothing to patch."
    return
  fi

  echo "Patching ${kind}/${ns}/${name} to remove privileged=true from containers..."
  kubectl apply -f "${patched_yaml}"
}

# ----- main remediation loop -----
# Collect unique owner objects to patch
OWNERS_JSON="${WORK_DIR}/owners.json"
jq '
  map(select(.ownerKind != null and .ownerName != null))
  | map({podNamespace, ownerKind, ownerName})
  | unique
' "${OFFENDERS_JSON}" > "${OWNERS_JSON}"

OWNERS_COUNT="$(jq 'length' "${OWNERS_JSON}")"
if [[ "${OWNERS_COUNT}" -gt 0 ]]; then
  echo "Patching ${OWNERS_COUNT} owning workloads (Deployments/DaemonSets/StatefulSets/Jobs/CronJobs)..."
  for i in $(seq 0 $((OWNERS_COUNT - 1))); do
    ns="$(jq -r ".[$i].podNamespace" "${OWNERS_JSON}")"
    kind="$(jq -r ".[$i].ownerKind" "${OWNERS_JSON}")"
    name="$(jq -r ".[$i].ownerName" "${OWNERS_JSON}")"

    # Only patch expected workload kinds
    case "${kind}" in
      Deployment|DaemonSet|StatefulSet|Job|CronJob)
        patch_workload "${ns}" "${kind}" "${name}"
        ;;
      *)
        echo "WARN: Unsupported owner kind ${kind} for ${ns}/${name}; manual review required."
        ;;
    esac
  done
else
  echo "No controller-owned workloads detected; all offending pods appear to be bare Pods."
fi

# ----- manual follow-up for bare Pods or unsupported owners -----
BARE_PODS_TXT="${WORK_DIR}/manual-bare-pods.txt"
jq -r '
  map(select(.ownerKind == null or .ownerName == null))
  | group_by(.podNamespace, .podName)
  | .[]
  | "Pod " + .[0].podNamespace + "/" + .[0].podName
' "${OFFENDERS_JSON}" | sort -u > "${BARE_PODS_TXT}" || true

if [[ -s "${BARE_PODS_TXT}" ]]; then
  echo
  echo "The following Pods have privileged containers but are not owned by a supported controller."
  echo "They must be fixed manually by editing/recreating the Pod manifests:"
  cat "${BARE_PODS_TXT}"
  echo
  echo "For each listed Pod, obtain the manifest, remove securityContext.privileged: true from"
  echo "all containers and initContainers (and, if needed, add only specific capabilities via"
  echo "securityContext.capabilities.add), then recreate the Pod from a controller or as needed."
fi

# ----- verification (re-run the authoritative audit) -----
echo
echo "Re-running compliance audit to verify remediation..."
kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | ((.spec.containers // []) + (.spec.initContainers // []))[]
  | (.securityContext.privileged // false) as $priv
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + " container=\(.name) image=\(.image) privileged=\($priv)"
    + " is_compliant=\(if $priv then "false" else "true" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Containers Should Not Run In Privileged Mode

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation