Pod Security Standard Checker

The Pod Security Standards (PSS) describe three policies: Privileged, Baseline and Restricted. The Pod Security Standard Checker parses a pasted Pod or workload manifest and reports which controls fail for each policy.

It checks host namespaces, privileged containers, dangerous capability additions, runAsNonRoot, allowPrivilegeEscalation, dropping ALL capabilities, seccompProfile and non-root runAsUser. The pod template is extracted from Deployments/StatefulSets/DaemonSets automatically.

Parsing is done with a small tolerant YAML reader (no external dependency). Problems are reported in a clear panel. Everything runs locally and nothing is uploaded.

• Three policies - Privileged, Baseline, Restricted.
• Common controls - namespaces, privilege, capabilities, seccomp, users.
• Workload aware - extracts pod spec from Deployment/StatefulSet/DaemonSet.
• Paste input - no upload, fully local.
• Copy / Download / Print - take the report anywhere.

1. Paste a Pod or workload YAML.
2. Run the check and read the per-policy results.
3. Copy or download the report.

Example 1 - privileged pod. hostPID + privileged -> Baseline and Restricted fail.

Example 2 - restricted pod. runAsNonRoot, drop ALL, seccomp RuntimeDefault -> all pass.

• Auditable - see exactly which control fails.
• Fast - instant client-side feedback.
• Private - all in the browser.
• Educational - learn PSS controls.
• Copy, download or print - take it anywhere.