What are your Kubernetes manifests handing to the node?

One privileged: true, a hostPath to docker.sock, hostNetwork: true or a container running as root can turn a bug in one pod into control of the node. Paste your own Pod, Deployment, StatefulSet, DaemonSet, Job or CronJob YAML below and this page lists each risky setting with its line, the resource and container, the risk, and the exact YAML fix.

Nothing is uploaded. The YAML you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a heuristic line scan, not a YAML parser, not a security audit and not a compliance claim.

1. Paste your manifest

Paste the contents of your own manifest. Multi-document files separated by --- work. Add more blocks for more files, and give each its real file name so findings point at the right file. Render Helm charts first with helm template.

Paste at least one manifest above and click Check.

Findings

File : Line	Resource	Type	Risk	Fix

Heuristic line scan, not a YAML parser, not a security audit and not a compliance claim. Review each finding yourself.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                        # scan *.yaml / *.yml under the current directory
python3 check.py deploy.yaml k8s/       # scan specific files or directories
python3 check.py --format json          # machine-readable
python3 check.py --fail-on-risk         # exit 2 on any medium or high finding

Get check.py from the repo — stdlib only, nothing to install, no network calls. It skips node_modules, vendor, .git, build folders and Helm template files.

Common questions

What makes a Kubernetes pod spec risky?

Settings that hand a container the node or leak a credential: privileged: true, hostNetwork, hostPID or hostIPC, hostPath volumes such as /etc or the Docker socket, capabilities like SYS_ADMIN or ALL, a missing allowPrivilegeEscalation: false, running as root, a writable root filesystem, :latest images and passwords written as literal env values. Any one of them can turn a bug in one container into control of the node.

Why is privileged: true dangerous in Kubernetes?

A privileged container gets nearly every Linux capability and access to the node's devices, so a compromised process can mount the node filesystem, load kernel modules and escape to the host. Almost every real need is narrower: add one capability such as NET_ADMIN under capabilities.add, and keep privileged off.

What should securityContext contain?

A sensible baseline per container is allowPrivilegeEscalation: false, runAsNonRoot: true with a numeric runAsUser, readOnlyRootFilesystem: true, capabilities drop: [ALL] and seccompProfile type RuntimeDefault. Add back only what the workload demonstrably needs.

Does this tool send my manifests anywhere?

No. It makes no network calls at all. The YAML you paste is scanned in this page and never leaves your device, and secret values are never printed in the results.

Does a clean scan mean my cluster is secure?

No. This is a heuristic line scan, not a YAML parser, a full audit or a compliance claim. It reads only the patterns listed here, does not expand Helm templates, Kustomize overlays or anchors, and cannot see your cluster's admission policies, RBAC, network policies or images. Have a qualified person review anything that protects valuable data.

More: which Kubernetes pod settings are risky, and how do you fix each one?

More free tools

Free and private, like this one — everything runs in your browser, and nothing you type is uploaded.

Run this check from a terminal, in CI or as a pre-commit hook

The same checker as this page, as one Python file with no dependencies. Nothing is sent anywhere; it reads the files you point it at.

curl -fsSLO https://marisstella.app/k8s-pod-security-check/check.py
python3 check.py --fail-on-risk .

GitHub Actions (after actions/checkout). It fetches this whole repository, so pin a commit rather than main in real use:

- uses: duncan-haywood/oss-monorepo/platform/distribution/actions/k8s-pod-security-check@main
  with:
    path: .
    fail-on-risk: 'true'

pre-commit (.pre-commit-config.yaml):

- repo: https://github.com/Duncan-Haywood/oss-monorepo
  rev: main  # pin a commit in real use
  hooks:
    - id: k8s-pod-security-check

Nix: nix run github:duncan-haywood/oss-monorepo#k8s-pod-security-check -- --fail-on-risk .

Free, and staying free. If one of these saved you time or money, you can sponsor on GitHub or buy me a coffee. Either is optional and changes nothing about what these tools do.