auditing-host-mount-and-device-exposurelisted

# Auditing host mount and device exposure: a path into the node filesystem A hostPath volume or a device mount is a hole cut in the container boundary: it connects the workload directly to the node's filesystem or hardware. Sometimes that is genuinely needed, a node agent reading a specific system directory, but the exposure is defined by what the mount reaches, not by why it was added. A writable hostPath into a sensitive node directory lets the workload alter node state; a mount of the host root or a broad system path exposes other pods' data, node configuration, and credentials; a raw device or block volume grants low-level access that bypasses filesystem controls; and a hostPath with loose subpath or symlink handling can be walked out of its intended directory into the rest of the node. The audit treats each host mount as node reach and asks how far it goes. You audit this by inventorying every host-path and device mount and determining exactly what node state each exposes and whether it is writable. ## When to use - Workloads mount hostPath volumes or devices that connect the container to the node filesystem or hardware. - A mount may reach a sensitive node directory, the host root, or a raw device broader than the workload needs. - A hostPath's subpath or symlink handling may let a workload escape the intended directory into the node. ## Scope check Audit host mounts only on clusters and nodes you own or are authorized to assess, on non-production nodes. Confirming