Given the following container configuration: ``yaml runAsUser: 1000 containers: - name: sec-ctx-demo-2 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 0 privileged: True…

This question tests knowledge of Kubernetes container SecurityContext best practices - specifically identifying and correcting configurations that grant excessive or root-level privileges to a container.

Submitted by alyssa_d· May 4, 2026Runtime Security

Question

Given the following container configuration:

runAsUser: 1000
containers:
 - name: sec-ctx-demo-2
 image: gcr.io/google-samples/node-hello:1.0
 securityContext:
 runAsUser: 0
 privileged: True
 allowPrivilegeEscalation: false

Fix two fields present in the file being prominent security best practice issues. Don't add or remove configuration settings; only modify the existing configuration settings. Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487.

Explanation

Approach. Two fields violate security best practices: (1) runAsUser: 0 runs the container as root, which should be changed to runAsUser: 5487 (the unprivileged test-user) to follow least-privilege principles. (2) privileged: True grants the container near-host-level kernel capabilities and direct device access, which is a critical risk - it must be changed to privileged: false. The field allowPrivilegeEscalation: false is already correctly hardened and should not be touched. The corrected securityContext should be: runAsUser: 5487, privileged: false, allowPrivilegeEscalation: false.

Concept tested. Kubernetes Pod/Container SecurityContext hardening - identifying and remediating root user execution (runAsUser: 0) and privileged container mode (privileged: true) as violations of the principle of least privilege in CKS/CKA security contexts.

Reference. Kubernetes docs: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - also covered under CKS exam domain 'Minimize Microservice Vulnerabilities'

Topics

#Security Context#Least Privilege#Container Security#Privileged Containers

Community Discussion

No community discussion yet for this question.

Full CKS Practice