CPU requests should be set to ensure the sum of the resource requests of the scheduled Containers is less than the capacity of the node

CPU requests should be set to ensure the sum of the resource requests of the scheduled Containers is less than the capacity of the node

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Memory requests should be defined for each container. This allows the kubelet to reserve the requested amount of system resources and prevents over-provisioning on individual nodes

Memory requests should be defined for each container. This allows the kubelet to reserve the requested amount of system resources and prevents over-provisioning on individual nodes

Containers should drop 'ALL' or at least 'NET_RAW' capabilities