Platform policy for ordinary city apps requires containers not to gain extra privileges beyond their start UID. Which securityContext field should be set to false by default?
Select an answer to reveal the explanation.
Short Explanation
allowPrivilegeEscalation is the "can this process grab a bigger badge later?" switch. Setting it false blocks setuid-style jumps above the container's start privileges. Turning other hardening flags off—or enabling privileged—goes the wrong way.
Full Explanation
allowPrivilegeEscalation: false prevents a process from gaining more privileges than its parent (for example via setuid binaries). It is a standard hardening default for application Pods. Leaving it true, disabling runAsNonRoot, or setting privileged: true weakens rather than hardens the workload.