Sysdig - Remediate Workload :guestbook-ui

[sysdig-aws-us-2]

Sysdig opened the pull request on behalf of Alex Wang.

Sysdig analysis found violations for workload "guestbook-ui"

The PR includes remediations for the following attributes: "SecurityContext.AllowPrivilegeEscalation"

---

Remediated Attribute: "SecurityContext.AllowPrivilegeEscalation"

• Severity: 🔴 High
• Source:
  • Container: guestbook-ui
• Violated Control:
  • Container allowing privileged sub processes
    A sub-process can gain more privileges than the parent process.
• Change Impact: The container will not be able to spawn new processes with privileged mode. All new process will have privileged set to false.

The following policy requirements applied to this resource include the above control:

Requirement	Policy
4.2.5 Minimize the admission of containers with allowPrivilegeEscalation	CIS Amazon Elastic Kubernetes Service (EKS) Benchmark
Kubernetes Controls	All Findings