The Baseline profile prevents Pods from elevating privileges to gain administrative access while preserving compatibility with typical applications. It provides a practical default for nonadministrative workloads. section 12.5.1 section 12.5.2
Apply the profile according to the workload’s operational role:
- Use Baseline for ordinary application workloads to reduce the impact of a compromised container without commonly breaking application compatibility. section 12.5.2
- Reserve the Privileged profile for administrative or system workloads that genuinely require unrestricted administrative access. section 12.5.1
- Place administrative workloads in separate namespaces from common application workloads. section 12.5.2
Choosing between Baseline and Restricted
Restricted adds defense-in-depth requirements, including running containers as non-root, and can require security-context changes. Baseline offers a broader compatibility margin when those requirements are impractical. section 12.5.1 section 12.5.2
