Privilege Escalation in Containers

Why should containers avoid running as root, and what K8s controls help (runAsNonRoot, readOnlyRootFilesystem, drop capabilities)?

Answers use simple, clear English.