CKS System Hardening Practice Question
A pod spec includes 'hostPID: true' and 'hostNetwork: true'. What security concern does this raise?
⚠ Common exam trap
CNCF often tests the distinction between namespace sharing (`hostPID`, `hostNetwork`, `hostIPC`) and volume mounts or device access; the trap here is that candidates confuse `hostNetwork` with host filesystem access or assume `hostPID` implies device access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The container can see all host processes and access the host network namespace, increasing the risk of privilege escalation
Setting `hostPID: true` allows the container to see all processes running on the host, which can leak sensitive information and enable process injection. Setting `hostNetwork: true` gives the container direct access to the host's network namespace, bypassing network policies and potentially allowing the container to bind to privileged ports or sniff traffic. Together, these settings significantly increase the attack surface and risk of privilege escalation or host compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container can use the host's GPU and other devices
Why it's wrong here
HostPID and hostNetwork only alter namespace sharing; they do not grant access to hardware devices. GPU access depends on device plugins, resource limits like nvidia.com/gpu, and runtime support (e.g., NVIDIA Container Toolkit), not on these pod-level namespace flags. Without a device plugin and the appropriate privileged/CAP_SYS_ADMIN permissions, the container cannot use the host GPU or other devices.
- ✓
The container can see all host processes and access the host network namespace, increasing the risk of privilege escalation
Why this is correct
When hostPID is true, the container shares the host's PID namespace, allowing it to list and signal every process on the node; with hostNetwork true, it attaches to the host network namespace, so it can bind to host ports and observe host network traffic. This combination weakens isolation substantially: a compromised container could use ptrace (if permitted) or sniff network packets, increasing the chance of privilege escalation to the host. It also bypasses typical container network policies and process-level sandboxing.
- ✗
The container can read and write to the host filesystem
Why it's wrong here
This setting does not mount the host filesystem into the container. Reading or writing host paths requires explicit hostPath volumes or, in some runtimes, a privileged container with host mounts; PID and network namespace sharing only expose process and network metadata. Even though the container may see host processes, it cannot access their files or random host files unless a volume is actually attached.
- ✗
The container cannot use a securityContext
Why it's wrong here
A securityContext is always allowed on a container or pod, even when hostPID or hostNetwork is enabled. However, some fields may conflict in practice: for example, seccomp/AppArmor profiles or readOnlyRootFilesystem may not behave as expected with host namespaces, and enabling hostPID may require you to relax the no-new-privileges setting if you need ptrace. The correct takeaway is that you can still define securityContext, but you must audit it against the elevated host access.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.