A main civic container is hardened, but a logging sidecar requests CAP_SYS_ADMIN. What should the candidate conclude?
Select an answer to reveal the explanation.
Short Explanation
A side door with a master key still opens the whole building. Sidecars get the same securityContext scrutiny as the main app—drop wild capabilities like CAP_SYS_ADMIN unless truly justified. Logging does not need that hammer.
Full Explanation
Every container in a Pod, including sidecars, has its own securityContext and capability set. Privilege escalation via CAP_SYS_ADMIN in a sidecar undermines Pod hardening even if the main container is constrained. kubectl logs does not require CAP_SYS_ADMIN, and ServiceAccount RBAC is separate from Linux capabilities.