Home / Knowledge hub / Privileged container
Knowledge hub
Privileged container
A container given near-host powers, so a flaw inside it is a flaw in the host.
What it means
A privileged container is one started with most of the isolation switched off. It can see the host's devices, hold nearly all Linux capabilities and skip many of the restrictions that normally keep a container in its box.
In Docker it is the --privileged flag. In Kubernetes it is a setting named privileged in the security context of a container. The name is accurate: it is the mode with the privileges.
Why it matters
Anything running inside has close to root-level control of the host. A bug in the application, or a bad dependency, then gives an attacker the host rather than just a container, and from there the rest of the node and its secrets.
It also breaks the promise that teams can share a cluster safely. One workload asking for privilege lowers the safety of all its neighbours, which is why standards treat it as the most permissive level.
How it shows up
It is usually added to get something working. A build job needs to run Docker, a monitoring agent needs host access, a developer hits a permission error and tries the flag. Then it is left in the manifest, and later copied into the next one.
Look for privileged: true, host paths, host networking and added capabilities in manifests. Use the pod security standards to forbid it by default, and grant narrow capabilities or use purpose-built tools when a workload needs something specific.
Questions people ask
Privileged container, answered
When is a privileged container justified?
Rarely. Some low-level system agents, such as storage or networking components, really do need it. Ordinary application workloads almost never do.
How do we find them?
Search manifests and the live cluster for the privileged setting, and block it with an admission rule so new ones cannot appear unnoticed.
Is root in a container the same thing?
No. A container can run as root and still be isolated. Privileged mode removes much of that isolation, which makes root far more dangerous.
Can we give a container just one extra power?
Yes. Linux capabilities let you add a specific one rather than everything. That is much safer than the full privileged flag.
Does privileged mode cause a container escape?
It makes one trivial. The step between the container and the host is mostly gone.
Sources
Where this comes from
Related
Terms that sit next to this one
Container escape
Breaking out of a container to reach the machine that hosts it.
Pod security standards
Built-in Kubernetes levels that restrict risky settings in pods.
Admission controller
A cluster gate that can reject workloads breaking your security rules.
Rootless container
A container run as an ordinary user, limiting damage if it is broken into.
Least privilege
Giving every person and service the minimum access the job requires.
Does this workload need host powers?
We cover the application side: finding the flaws a foothold would start from and proving them. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.