Glossary
Privileged container
A container run with securityContext.privileged: true: all Linux capabilities and host device access, which makes escape to the node trivial.
A privileged container has securityContext.privileged: true in its Pod spec. It gets all Linux capabilities and access to the host's devices, so it can mount the node's disk or, combined with hostPID or a hostPath of /, take over the node (ATT&CK T1611, Escape to Host).
Some infrastructure DaemonSets (CNI, storage, security agents) legitimately run privileged; anything else should not. The Baseline Pod Security Standard, enforced by Pod Security Admission, forbids it. In the audit log, the flag is only visible when workload writes are logged with request bodies. See privileged pods and container escape.