Q: What is a container escape in Kubernetes? Walk through common breakout vectors (privileged containers, hostPath volume mounts, dangerous Linux capabilities like CAP_SYS_ADMIN, unpatched runc CVEs) and how to prevent them using admission policies.

How attackers break out of container boundaries:

• 1. Privileged Containers (privileged: true): Disables almost all seccomp profiles, apparmor, and gives container full access to /dev on the host node. An attacker simply runs nsenter --mount=/proc/1/ns/mnt to instantly drop into the host shell.
• 2. Dangerous HostPath Mounts: Mounting sensitive host directories like /var/run/docker.sock, /etc/kubernetes, or /. Writing to the host filesystem allows modifying cron jobs or injecting SSH authorized keys.
• 3. Dangerous Linux Capabilities (CAP_SYS_ADMIN): Allows mounting filesystems, injecting kernel modules, and manipulating cgroups via release_agent notifications to execute arbitrary commands on the host.
• 4. Kernel & Runtime Exploits: Unpatched vulnerabilities in the host Linux kernel (Dirty COW, Dirty Pipe) or OCI runtimes (runc CVE-2019-5736 overwrite exploit).

How CAP_SYS_ADMIN enables host code execution:

• This exploit executes the script with root privileges directly in the host namespace when the cgroup process terminates.

Enforcing non-negotiable security guardrails:

• 1. Pod Security Standards (Restricted Profile): Enforce pod-security.kubernetes.io/enforce: restricted at the namespace level to forbid privileged containers, hostNetwork, hostPID, and require rootless execution.
• 2. Drop ALL Capabilities: Configure securityContext.capabilities.drop: ['ALL'] and only add back specific required capabilities (e.g., NET_BIND_SERVICE).
• 3. Read-Only Root Filesystem: Set readOnlyRootFilesystem: true so attackers cannot write binary payloads to disk.
• 4. Sandboxed Runtimes: For untrusted multi-tenant workloads, use hardware-virtualized runtimes like Kata Containers or kernel-intercepting runtimes like gVisor (runsc).

Rejecting insecure manifests before admission:

• Automated admission webhooks guarantee that developer mistakes cannot bypass cluster security baselines.