Kubernetes Security: Using insecure sysctls

Problem

Some sysctls can turn off security features or affect every container on a host.

Description

Some sysctls can turn off security features or affect every container on a host, so they should be blocked except for a small “safe” list. A sysctl counts as safe only when it’s namespaced to its own container or Pod and kept separate from other Pods or host processes on the same node.

Solution

Consider removing all insecure sysctls, or use only the following safe ones:

• Undefined/nil
• kernel.shm_rmid_forced
• net.ipv4.ip_local_port_range
• net.ipv4.ip_unprivileged_port_start
• net.ipv4.tcp_syncookies
• net.ipv4.ping_group_range
• net.ipv4.ip_local_reserved_ports (since Kubernetes 1.27)
• net.ipv4.tcp_keepalive_time (since Kubernetes 1.29)
• net.ipv4.tcp_fin_timeout (since Kubernetes 1.29)
• net.ipv4.tcp_keepalive_intvl (since Kubernetes 1.29)
• net.ipv4.tcp_keepalive_probes (since Kubernetes 1.29)

Problematic code

apiVersion: v1
kind: Pod
metadata:
  name: unsafe-sysctl-demo
spec:
  securityContext:
    sysctls:
      - name: net.core.somaxconn
        value: "1024"
      - name: kernel.msgmax
        value: "65536"
  containers:
    - name: nginx
      image: nginx:1.29-alpine
      ports:
        - containerPort: 80

Verified code

apiVersion: v1
kind: Pod
metadata:
  name: safe-sysctl-demo
  labels:
    app: demo
spec:
  securityContext:
    sysctls:
      - name: net.ipv4.ip_local_port_range
        value: "1024 65535"
      - name: net.ipv4.tcp_syncookies
        value: "1"
      - name: net.ipv4.tcp_keepalive_time     # ≥ 1.29
        value: "7200"
      - name: net.ipv4.tcp_keepalive_intvl    # ≥ 1.29
        value: "75"
      - name: net.ipv4.tcp_keepalive_probes   # ≥ 1.29
        value: "9"
  containers:
    - name: nginx
      image: nginx:1.29-alpine
      ports:
        - containerPort: 80
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true

Source of the description:Pod Security Standards