Skip to content
Solvex Space

Cybersecurity · free, no signup

Kubernetes Manifest Analyzer

Paste a Kubernetes manifest and see what the workload can actually reach on the node it lands on. The finding it exists for is that a hostPath mount of / or /var/run/docker.sock is node root whatever the securityContext above it says — mounting the container runtime's socket hands the pod the ability to start any container it likes, privileged, on that node. Also covers privileged containers, hostNetwork, hostPID and hostIPC, runAsNonRoot left unset, allowPrivilegeEscalation, added capabilities against whether ALL was dropped, missing resource limits, automounted service-account tokens, writable root filesystems, mutable image tags and secrets inlined as literal environment values. A manifest whose kind it does not recognise is reported as unassessed rather than clean.

Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.

Paste a Kubernetes manifest and see what the workload can reach once it is scheduled. A hostPath mount of /var/run/docker.sock is node root whatever the securityContext above it says — it hands the pod the ability to start any container it likes, privileged, on that node.

Runs on the text you paste — no cluster is contacted, so admission controllers, Pod Security Standards and policy engines that might reject this manifest are not visible here. A kind the tool does not recognise is reported as unassessed, never as clean.

YAML or JSON. Remove real secret values before pasting.

What happens to what you enter

  • The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
  • Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
  • An email address is stored only where a tool offers to send you a report and you choose to give one.

Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.

When a free check is not enough

This tool reads what is public and reports what it can see. The Kubernetes Security Review engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.

Explore Kubernetes Security Review
Kubernetes Manifest Analyzer — Solvex Space