Q: In Kubernetes, what is a "Container Escape" vulnerability, and why is running a container with `privileged: true` extremely dangerous?

Containers are not true virtual machines; they are merely isolated processes sharing the same underlying Linux host kernel, governed by namespaces and cgroups. A Container Escape occurs when an attacker breaks out of this isolation and gains direct root access to the underlying host node (and thereby all other containers on that node). Running a container with privileged: true is inherently dangerous because it disables almost all security namespace isolation. It grants the container full access to the host's devices (/dev) and allows it to execute unrestricted system calls to the kernel. If a process inside a privileged container runs as root, and an attacker compromises that process, they are effectively root on the host Kubernetes node itself.