Missing Capability Restrictions

Description

Detects containers that do not drop unnecessary Linux capabilities.

What Shoulder detects

Container doesn't drop unnecessary Linux capabilities.

How to fix

Drop all capabilities in securityContext.

```yaml
securityContext:
  capabilities:
    drop: [ALL]
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-250/missing-drop-capabilities

Applies to

Languages

📄 YAML

Frameworks

kubernetes

References

Documentation ↗ Learn about CWE-250

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=kubernetes-missing-drop-capabilities .