ECS containers should run as non-privileged

How to fix it

Leave privileged out of every container definition in the family's latest active revision, or set it to false. A container needing one host capability should request it through linuxParameters rather than take the whole flag, and one quietly depending on privileged access, mounting a device or loading a kernel module, fails to start without it. This needs a new revision, with every service and scheduled task repointed at it.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

With Terraform

resource "aws_ecs_task_definition" "this" {
  family = "example"

  container_definitions = jsonencode([{
    name       = "app"
    image      = var.container_image
    privileged = false
  }])
}