Setting allowPrivilegeEscalation to false in a container's securityContext prevents what?

Setting allowPrivilegeEscalation to false in a container's securityContext prevents what?

• A. It prevents the escalation of privileges in the container
• B. It disables all capabilities in the container
• C. It prevents the container from running as root on the node
• D. It turns off all network policies

Answer: (A)

Preventing privilege escalation within the container. When allowPrivilegeEscalation is false, processes inside the container cannot gain higher privileges than they started with, such as via setuid/setgid tricks or acquiring extra capabilities. This reduces the risk of a leaking privilege upgrade that could affect the host or other workloads. It doesn’t disable all capabilities or affect network policies, and it doesn’t by itself prevent running as root on the node—those are controlled by other settings.

Preventing privilege escalation within the container. When allowPrivilegeEscalation is false, processes inside the container cannot gain higher privileges than they started with, such as via setuid/setgid tricks or acquiring extra capabilities. This reduces the risk of a leaking privilege upgrade that could affect the host or other workloads. It doesn’t disable all capabilities or affect network policies, and it doesn’t by itself prevent running as root on the node—those are controlled by other settings.