Falco low stable other

Container Run as Root User

Container detected running as the root user. This should be taken into account especially when policies disallow containers from running with root user privileges. Note that a root user in containers doesn't inherently possess extensive power, as modern container environments define privileges through Linux capabilities. To learn more, check out the rule "Launch Privileged Container".

View Source

Detection Logic

spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container

Field Validations

Loading…

Comments (0)

Loading comments...