René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Feature Request: Add support for allowPrivilegeEscalation check in init/ephemeral containers","articleBody":"Hi!\r\n\r\nCurrently, StackRox policies do not apply `allowPrivilegeEscalation` checks to init/ephemeral containers. \r\n\r\nWe request support for this setting to ensure privilege escalation restrictions are enforced consistently across all container types.\r\n\r\nUse Case:\r\nI'm testing default policy `Container with privilege escalation allowed` using manifest below and there is no violation: \r\n```\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: init-container-privilege-test\r\nspec:\r\n  initContainers:\r\n    - name: init-test-container\r\n      image: busybox\r\n      command: [\"sh\", \"-c\", \"echo Init container\"]\r\n      securityContext:\r\n        allowPrivilegeEscalation: true\r\n  containers:\r\n    - name: main-container\r\n      image: nginx\r\n      securityContext:\r\n        allowPrivilegeEscalation: false\r\n```","author":{"url":"https://github.com/GurbanV","@type":"Person","name":"GurbanV"},"datePublished":"2024-10-28T19:33:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/13133/stackrox/issues/13133"}