Why `Prevent containers from accessing host files by using high UIDs` request uid > 10 000 about datree HOT 8 CLOSED

Hi @Socolin, this is considered a best-practice by many security-focused entities. The aim is to provide a buffer in order to avoid conflicts with the host's user table, and this is agreed-upon as a reasonable buffer.
The security perspective is that even with other UIDs, we risk impersonating another user on the host system if the container is compromised. To drastically reduce the probability, configured users should only start from UID 10,000.

Some references:

1. https://cloudogu.com/en/blog/k8s-app-ops-part-3-security-context-1 :

2. https://kubesec.io/basics/containers-securitycontext-runasuser/

from datree.

Thanks for the explanation.

I would have expect this to be handle by namespace, from what I see there is a user namespace in k8s now
https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces

from datree.

Yes, looks like user namespaces will mitigate this security risk, but this feature is only available in v1.25, so this rule is relevant to all earlier versions 👍

from datree.

Is there a way to specify the version used to datree to ignore this warning ?

from datree.

you can just turn off (disable) this rule and this way it will not run:
https://hub.datree.io/dashboard/policies#customizing-a-policy

from datree.

Is there any way to disable this with a file, in like ~/.config/datree/ or something like that to avoid adding annotation on every resources ? I'm using datree without an account (and I would like to avoid having a new secret to manage in the pipeline) so I don't have acces to this UI

from datree.

Hi @Socolin
You can skip a certain rule by adding the cli skip annotation. Here's a link to the docs: https://hub.datree.io/configuration/behavior#skip-specific-rules-for-a-single-object

from datree.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

from datree.