Limit Access to the Host Process ID Namespace

Description

Containers should not be allowed access to the host's process ID namespace. To prevent containers from getting access to a host's process ID namespace, the appropriate Security Context Constraints (SCCs) should set allowHostPID to false.

Rationale

A container running in the host's PID namespace can inspect processes running outside the container which can be used to escalate privileges outside of the container.