Read-Only filesystem for containers is not used misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_22
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

A read-only root filesystem helps to enforce an immutable infrastructure strategy. The container should only write on mounted volumes that can persist, even if the container exits. Using an immutable root filesystem and a verified boot mechanism prevents against attackers from "owning" the machine through permanent local changes. An immutable root filesystem can also prevent malicious binaries from writing to the host system.

How to Fix

Resource: Container

• Arguments: readOnlyRootFilesystem (Optional)

Defines whether a container is able to write into the root filesystem. Default to false. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: securityContext:
• readOnlyRootFilesystem: true

---