Container K8s Pentest

---
name: container-k8s-pentest
description: "Use when testing container and Kubernetes security — image and registry weaknesses, insecure container configuration (privileged, host mounts, capabilities), container escape, Kubernetes RBAC and API-server exposure, secrets handling, network policy gaps, and pod-to-cluster privilege escalation. Maps to MITRE ATT&CK Containers and CIS benchmarks. Authorized engagements only."
---

# Container & Kubernetes Penetration Testing

Security assessment of container images and orchestration. Mapped to **MITRE ATT&CK (Containers)** and CIS Docker/Kubernetes benchmarks.

## 0. Authorization gate
- [ ] Written scope: clusters/namespaces, registries, allowed intensity.
- [ ] Prod vs non-prod boundaries; no disruption to running workloads unless cleared.

## 1. Images & registry
- Scan images for known-vuln packages, embedded secrets, and excessive contents.
- Registry exposure/auth: anonymous pull/push, unsigned images.
- **Fix:** minimal/base images, image scanning in CI, signing + admission control, no secrets in layers.

## 2. Container configuration
- **Dangerous settings:** `--privileged`, host PID/network/IPC, host path mounts (esp. docker socket), added Linux capabilities, running as root.
- **Fix:** drop capabilities, non-root, read-only FS, no host mounts, seccomp/AppArmor, Pod Security Standards.

## 3. Container escape (in scope)
- Assess escape feasibility from misconfig (privileged/host-mount/socket) or kernel vulns → host compromise.
- **Fix:** the config hardening above; keep host/kernel patched; isolate workloads.

## 4. Kubernetes control plane
- **API server exposure** and anonymous/weak auth.
- **RBAC review:** over-permissive roles/bindings, wildcard verbs/resources, `cluster-admin` sprawl, service-account token abuse.
- **etcd** exposure (holds all secrets).
- **Kubelet** exposure (can allow command exec in pods).
- **Fix:** authn/authz on all components, least-privilege RBAC, restrict SA token automount, secure etcd, lock down kubelet.

## 5. Pod → cluster privilege escalation
- Mounted service-account tokens → API access; escalate via permissive RBAC; reach cloud metadata from pods (→ `cloud-pentest`).
- **Fix:** disable unnecessary token automount, least-privilege SAs, restrict metadata access from pods, network policies.

## 6. Secrets & network
- Kubernetes Secrets handling (base64 ≠ encryption; encryption-at-rest, external secret managers).
- Network policy gaps → unrestricted pod-to-pod / east-west movement.
- **Fix:** encrypt secrets at rest, external secret store, default-deny network policies.

## 7. Tooling
trivy/grype (images), kube-hunter/kube-bench (posture/CIS), kubectl + can-i (RBAC), peirates (escalation), amicontained (escape checks). Follow RoE.

## 8. Reporting
Present escape/escalation paths (container → node → cluster → cloud), blast radius, and hardening fixes. Checklist: `references/container-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>