❯ cat test.json
{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {
      "name": "hello-cpu-limit"
    },
    "spec": {
      "containers": [
        {
          "command": [
            "sh",
            "-c",
            "echo 'Hello' && sleep 1h"
          ],
          "image": "busybox",
          "name": "hello"
        }
      ]
    }
  }%

❯ trivy conf test.json
...
LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.json:7-12
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   7 ┌     "spec": {
   8 │       "containers": [
   9 │         {
  10 │           "command": [
  11 │             "sh",
  12 └             "-c",
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
...

❯ cat test.yaml
apiVersion: v1
kind: Pod
metadata:
  name: hello-cpu-limit
spec:
  containers:
  - command:
    - sh
    - "-c"
    - echo 'Hello' && sleep 1h
    image: busybox
    name: hello

❯ trivy conf test.yaml
...
LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 test.yaml:7-12
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   7 ┌   - command:
   8 │     - sh
   9 │     - "-c"
  10 │     - echo 'Hello' && sleep 1h
  11 │     image: busybox
  12 └     name: hello
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
...

-

Version: 0.56.1