Falco low stable other
Container Run as Root User
Container detected running as the root user. This should be taken into account especially when policies disallow containers from running with root user privileges. Note that a root user in containers doesn't inherently possess extensive power, as modern container environments define privileges through Linux capabilities. To learn more, check out the rule "Launch Privileged Container".
Detection Logic
spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container Field Validations
Loading…
Comments (0)
Loading comments...