Investigation

Treat the manifest as evidence of your production blast radius.

Safe investigation sequence:

1. Inspect context fields: Check the pod and container-level securityContext in the running cluster.
2. Confirm non-root status: Verify that the workload is actually running as a non-zero UID.
3. Identify requirement: Determine the exact path or Linux capability the application actually needs.
4. Fix the gap: Address the specific requirement (e.g., by adding an emptyDir volume) instead of widening the entire privilege model.

The goal is to fix the application without making it “soft.”

Containment

Containment means keeping the security baseline intact even during emergency repairs.

Containment steps:

1. Preserve non-root: Do not switch to root execution to bypass permission errors.
2. Add targeted volumes: Use explicit writable volumes for only the paths that need them.
3. Keep escalation disabled: Ensure allowPrivilegeEscalation remains false.
4. Verify baseline: Confirm the workload still passes security checks after the fix is applied.

Pause and Predict: What automated guardrail would have prevented this incident entirely?