Privileged container
A privileged container is a container granted broad host-level permissions or capabilities that substantially reduce its normal isolation from the host.
Google Anthos in Action
A privileged container is a container granted broad host-level capabilities, kernel access, and device access through privileged mode.
- How it is used
- Controls whether Kubernetes workloads can access host resources when defining cluster security policy.
- How deep it goes
- Works through user-and-privilege permission combinations and kernel-change tests, then outlines admission-policy enforcement.
- Examples
- Uses a kernel-setting test, a permission matrix, and a dry-run constraint matching Pods.
- What you can do after
- Operate/configure it by assessing host-access risk and testing a Gatekeeper constraint before denying privileged Pods.
Read how Google Anthos in Action explains privileged container →
Kubernetes in Action, Second Edition
A privileged container is a container whose processes receive unrestricted or nearly unrestricted access to the host kernel's operations.
- How it is used
- Uses elevated kernel access for node agents and workloads that must perform operations unavailable to ordinary containers.
- How deep it goes
- Explains system calls, full kernel access, and capability-based alternatives, but does not detail individual seccomp profiles.
- Examples
- Demonstrates Docker --privileged, Kubernetes kube-proxy, and kindnet configurations.
- What you can do after
- Apply Kubernetes securityContext settings or Docker's --privileged flag while preferring only the capabilities a workload requires.
Read how Kubernetes in Action, Second Edition explains privileged container →
Related concepts
- security contextconfigured by · A security context is security-related configuration or execution state associated with a subject, request, container, or runtime environment.
- isolationcontrasts with · Isolation is the separation of components, processes, resources, or contexts to limit interaction, interference, or the propagation of effects between them.
- containerconfigures · A software container is an isolated execution environment that packages an application and its dependencies while sharing the host operating system kernel.
- CAP_SYS_ADMINuses · CAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.
- operating system kerneluses · An operating system kernel is privileged core software that manages hardware and system resources while providing fundamental services to other software.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.