policy auth_error ai_generated true

Error: container has runAsNonRoot and image will run as root. PodSecurityPolicy: Privileged containers are not allowed. PodSecurityPolicy: allowedCapabilities is empty: drop all capabilities

ID: policy/kubernetes-psp-privileged-container-blocked

Also available as: JSON · Markdown · 中文

82%Fix Rate

87%Confidence

1Evidence

2024-01-10First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
Kubernetes v1.24 (PSP deprecated, replaced by Pod Security Admission)	active	—	—	—
PodSecurityPolicy API v1beta1	active	—	—	—
Open Policy Agent v3.0.0	active	—	—	—

Root Cause

A PodSecurityPolicy (or OPA/Gatekeeper constraint) denies the pod because the container image requires root or privileged capabilities, conflicting with the policy's runAsNonRoot requirement and empty allowedCapabilities.

generic

中文

PodSecurityPolicy（或 OPA/Gatekeeper 约束）拒绝了 Pod，因为容器镜像需要 root 或特权能力，与策略的 runAsNonRoot 要求和空的 allowedCapabilities 冲突。

Official Documentation

https://kubernetes.io/docs/concepts/security/pod-security-policy/

Workarounds

90% success Modify the container image to run as a non-root user by adding a USER directive in the Dockerfile: FROM ubuntu:22.04 RUN useradd -m appuser USER appuser CMD ["/bin/bash"]
```
Modify the container image to run as a non-root user by adding a USER directive in the Dockerfile:

FROM ubuntu:22.04
RUN useradd -m appuser
USER appuser
CMD ["/bin/bash"]
```
75% success Update the PodSecurityPolicy to allow the required capabilities or set runAsNonRoot: false if the workload truly needs root, but evaluate security implications first.
```
Update the PodSecurityPolicy to allow the required capabilities or set runAsNonRoot: false if the workload truly needs root, but evaluate security implications first.
```

中文步骤

修改容器镜像以非 root 用户身份运行，在 Dockerfile 中添加 USER 指令：

FROM ubuntu:22.04
RUN useradd -m appuser
USER appuser
CMD ["/bin/bash"]

更新 PodSecurityPolicy 以允许所需的能力，或将 runAsNonRoot 设置为 false（如果工作负载确实需要 root），但首先评估安全影响。

Dead Ends

Common approaches that don't work:

Setting 'runAsNonRoot: false' in the pod spec 60% fail
The PSP still requires runAsNonRoot: true, so the pod will be rejected again; also weakens security.
Adding 'CAP_SYS_ADMIN' to the container's capabilities 80% fail
The PSP's allowedCapabilities is empty, so any capability addition is denied.
Deleting the PodSecurityPolicy resource entirely 50% fail
In many clusters, PSP is enforced by an admission controller; deleting the policy may cause other security gaps or the cluster to reject all pods.