Privilege Escalation in Containers
Why should containers avoid running as root, and what K8s controls help (runAsNonRoot, readOnlyRootFilesystem, drop capabilities)?
Answers use simple, clear English.
Audio N/AQuick interview answer
Root in a container is often root on shared kernel namespaces with weaker isolation than a VM. If escaped, impact is higher. Use non-root users, drop Linux capabilities (ALL then add back needed), read-only root FS, no privilege escalation, and seccomp/AppArmor profiles.
Detailed answer
Root in a container is often root on shared kernel namespaces with weaker isolation than a VM. If escaped, impact is higher. Use non-root users, drop Linux capabilities (ALL then add back needed), read-only root FS, no privilege escalation, and seccomp/AppArmor profiles. Many base images still default to root — fix in Dockerfile USER and PodSecurity.
Full explanation
Many base images still default to root — fix in Dockerfile USER and PodSecurity.
Real example & use case
PodSecurity Restricted standard rejects pods that request privileged: true.
Pros & cons
Pros: smaller blast radius. Cons: apps writing to / need emptyDir volumes rework.