Skip to content

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Glossary

hostPath volume

A Kubernetes volume that mounts a node path into a Pod; mounts of /, /etc, the kubelet directory or a runtime socket expose the whole node.

A hostPath volume mounts a path of the node's filesystem into a Pod. Mounting / exposes the whole node; /etc, /root and /var/lib/kubelet expose configuration, keys and kubelet credentials; /var/run/docker.sock or the containerd and CRI-O sockets let the pod start containers outside Kubernetes.

The Kubernetes RBAC good practices note that the right to create PersistentVolumes can amount to host filesystem access through hostPath. In the audit log, look for volumes[].hostPath.path in workload request bodies. See privileged pods and container escape.

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.