Query: Pod containers should run with a read only root file system

Description

Containers in a Pod should always run with a read only root file system. Using an immutable root filesystem and a verified boot mechanism prevents against attackers from owning the machine through permanent local changes. An immutable root filesystem can also prevent malicious binaries from writing to the host system.

Query

Tables used in this query:

• kubernetes_pod

Controls using this query:

• Pod containers should run with a read only root file system

SQL