Problem
Using privileged containers could lead to privilege escalation.
Description
Privileged mode and permissive securityContext settings reduce container isolation and can grant broad access to host resources. Attackers who compromise a privileged pod may gain capabilities that are unavailable in standard least-privilege deployments.
In secure clusters, privileged workloads should be rare, reviewed, and tightly scoped. For most applications, enabling privilege escalation is unnecessary and conflicts with Pod Security Standards and defense-in-depth controls.
Related rules: avoid host namespace sharing, avoid hostPath volumes, avoid insecure capabilities.
Solution
Set allowPrivilegeEscalation: false, avoid privileged: true, and grant only the minimum capabilities required by the workload.
Problematic code
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-deployment
labels:
app : goproxy
spec:
selector:
matchLabels:
app : goproxy
template:
metadata :
name : goproxy
labels :
app : goproxy
spec :
hostNetwork: true
containers :
-
name : mysql
image : mysql
securityContext:
allowPrivilegeEscalation: true Verified code
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-deployment
labels:
app : goproxy
spec:
selector:
matchLabels:
app : goproxy
template:
metadata :
name : goproxy
labels :
app : goproxy
spec :
hostNetwork: true
containers :
-
name : mysql
image : mysql
securityContext:
allowPrivilegeEscalation: false