Skip to main content

☑️ Prevent containers from accessing the underlying host

Kubernetes pods can use host bind mounts (i.e. directories and volumes mounted on the container host) in containers. Using a hostPath mount can enable attackers to break from the container and gain access to the underlying host. Therefore, it's not recommended to use bind mounts for application pods.

Targeted resources by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Enabled by default? True

Policy as code identifier: CONTAINERS_INCORRECT_KEY_HOSTPATH


This rule will fail

If the key hostPath is used:

spec:
volumes:
- name: myVolume

Rule output in the CLI

$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from accessing the underlying host [1 occurrence]
💡 Invalid key `hostPath` - refrain from using this mount to prevent an attack on the underlying host

How to fix this failure

Refrain from using the hostPath mount

spec:
volumes:
- name: myVolume

Read more