{
  "id": "policy/kubernetes-psp-privileged-container-blocked",
  "signature": "Error: container has runAsNonRoot and image will run as root. PodSecurityPolicy: Privileged containers are not allowed. PodSecurityPolicy: allowedCapabilities is empty: drop all capabilities",
  "signature_zh": "错误：容器设置了 runAsNonRoot 但镜像将以 root 身份运行。PodSecurityPolicy：不允许特权容器。PodSecurityPolicy：allowedCapabilities 为空：丢弃所有能力",
  "regex": "container has runAsNonRoot and image will run as root.*PodSecurityPolicy: Privileged containers are not allowed",
  "domain": "policy",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "A PodSecurityPolicy (or OPA/Gatekeeper constraint) denies the pod because the container image requires root or privileged capabilities, conflicting with the policy's runAsNonRoot requirement and empty allowedCapabilities.",
  "root_cause_type": "generic",
  "root_cause_zh": "PodSecurityPolicy（或 OPA/Gatekeeper 约束）拒绝了 Pod，因为容器镜像需要 root 或特权能力，与策略的 runAsNonRoot 要求和空的 allowedCapabilities 冲突。",
  "versions": [
    {
      "version": "Kubernetes v1.24 (PSP deprecated, replaced by Pod Security Admission)",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "PodSecurityPolicy API v1beta1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Open Policy Agent v3.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Setting 'runAsNonRoot: false' in the pod spec",
      "why_fails": "The PSP still requires runAsNonRoot: true, so the pod will be rejected again; also weakens security.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    },
    {
      "action": "Adding 'CAP_SYS_ADMIN' to the container's capabilities",
      "why_fails": "The PSP's allowedCapabilities is empty, so any capability addition is denied.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    },
    {
      "action": "Deleting the PodSecurityPolicy resource entirely",
      "why_fails": "In many clusters, PSP is enforced by an admission controller; deleting the policy may cause other security gaps or the cluster to reject all pods.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Modify the container image to run as a non-root user by adding a USER directive in the Dockerfile:\n\nFROM ubuntu:22.04\nRUN useradd -m appuser\nUSER appuser\nCMD [\"/bin/bash\"]",
      "success_rate": 0.9,
      "how": "Modify the container image to run as a non-root user by adding a USER directive in the Dockerfile:\n\nFROM ubuntu:22.04\nRUN useradd -m appuser\nUSER appuser\nCMD [\"/bin/bash\"]",
      "condition": "",
      "sources": []
    },
    {
      "action": "Update the PodSecurityPolicy to allow the required capabilities or set runAsNonRoot: false if the workload truly needs root, but evaluate security implications first.",
      "success_rate": 0.75,
      "how": "Update the PodSecurityPolicy to allow the required capabilities or set runAsNonRoot: false if the workload truly needs root, but evaluate security implications first.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "修改容器镜像以非 root 用户身份运行，在 Dockerfile 中添加 USER 指令：\n\nFROM ubuntu:22.04\nRUN useradd -m appuser\nUSER appuser\nCMD [\"/bin/bash\"]",
    "更新 PodSecurityPolicy 以允许所需的能力，或将 runAsNonRoot 设置为 false（如果工作负载确实需要 root），但首先评估安全影响。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://kubernetes.io/docs/concepts/security/pod-security-policy/",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.82,
  "resolvable": "true",
  "first_seen": "2024-01-10",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}