A reviewer rejects privileged: true on a routine citizen portal Deployment. Why is that setting inappropriate for ordinary application Pods?
Select an answer to reveal the explanation.
Short Explanation
privileged is the "full host toolkit" badge—fine for rare system helpers, not for a citizen web app. Ordinary Pods should stay constrained. It isn't a DNS or read-only-root requirement, and kubelets still honor it.
Full Explanation
A privileged container receives nearly all host capabilities and weakens isolation. CKAD-level application security expects ordinary services to run without privileged: true. The flag is unrelated to ClusterIP DNS needs, is not required for read-only roots, and remains effective when set.