<p>I want to set AllowPrivilegeEscalation to false in a nonprivileged container but running with CAP_SYS_ADMIN capability. As per docs &quot;AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has CAP_SYS_ADMIN.&quot; . In this case it will be set to true or false ?</p>

sacboy
<p>As you already found in <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">the docs</a>:</p>
<blockquote>
<p><code>AllowPrivilegeEscalation</code>: Controls whether a process can gain more
privileges than its parent process. This bool directly controls
whether the <code>no_new_privs</code> flag gets set on the container process.
<strong><code>AllowPrivilegeEscalation</code> is true always when the container is: 1) run as Privileged OR 2) has <code>CAP_SYS_ADMIN</code>.</strong></p>
</blockquote>
<p>In your case the container has <code>CAP_SYS_ADMIN</code> so it would have the <code>AllowPrivilegeEscalation</code> set to <code>true</code>.</p>
<p>This behavior is also explained in more detail in the <a href="https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/no-new-privs.md" rel="nofollow noreferrer">AllowPrivilegeEscalation design document</a>.</p>
