Kubernetes Security: Using hostPath volumes

Problem

Using hostPath volumes is insecure as it gives access to the node’s real file system

Description

hostPath mounts expose node directories to pods and bypass important workload isolation guarantees. A compromised container can inspect or modify host files depending on mount options and filesystem permissions.

This configuration is risky in multi-tenant clusters and usually unnecessary for application workloads. PersistentVolume-backed storage, projected volumes, or other constrained mechanisms provide safer alternatives for most use cases.

Related rules: avoid host namespace sharing, avoid privileged containers, avoid insecure procMount.

Solution

Remove insecure hostPath mounts unless there is a strict operational requirement and strong compensating controls around pod admission and node hardening.

Problematic code

apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  volumes:
  - name: host-root
    hostPath:
      path: /
      type: Directory
  containers:
  - name: test-container
    image: hashicorp/http-echo:0.2.3
    volumeMounts:
      - name: host-root
        mountPath: /host
        readOnly: true

Verified code

apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  containers:
  - name: test-container
    image: hashicorp/http-echo:0.2.3

Source of the description

Kubernetes Pod Security Standards