Library GenAI pods run as root and mount hostPath volumes to node scratch disks that may hold resident prompt fragments. What hardening priority applies?

Library GenAI pods running as root and mounting hostPath volumes to node scratch that may hold resident prompt fragments couple container compromise to host filesystem exposure. Hardening priority is non-root containers and avoiding hostPath mounts that expose prompt scratch data—least privilege for process identity plus isolation of ephemeral prompt-related files from the node’s broader filesystem. That reduces the chance that a compromised library chatbot container can read unrelated host paths or leave resident content on shared node disks.

Mounting the entire node filesystem read-write for faster embeddings maximizes host exposure and is the opposite of hardening. Disabling seccomp so the model can call any syscall removes a useful syscall filter layer for container escape resistance. Sharing one privileged DaemonSet across all city namespaces concentrates privilege and expands blast radius if that DaemonSet is abused.

Exam caveat: some GPU or device plugins need carefully scoped privileges; prefer dedicated device access patterns over blanket root and hostPath to scratch containing prompts. Operational check: review pod security standards or policies for GenAI namespaces, confirm runAsNonRoot and dropped capabilities, and ensure scratch for prompts uses ephemeral volumes without hostPath to sensitive node paths.