Skip to content

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Glossary

Privileged container

A container run with securityContext.privileged: true: all Linux capabilities and host device access, which makes escape to the node trivial.

A privileged container has securityContext.privileged: true in its Pod spec. It gets all Linux capabilities and access to the host's devices, so it can mount the node's disk or, combined with hostPID or a hostPath of /, take over the node (ATT&CK T1611, Escape to Host).

Some infrastructure DaemonSets (CNI, storage, security agents) legitimately run privileged; anything else should not. The Baseline Pod Security Standard, enforced by Pod Security Admission, forbids it. In the audit log, the flag is only visible when workload writes are logged with request bodies. See privileged pods and container escape.

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.