You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. <em><a href="#policies-specific-to-linux">This is Linux only policy</a> in v1.25+ <code>(spec.os.name != windows)</code></em></p>
329
+
<p>Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. <em><a href="#OS-specific policy controls">This is Linux only policy</a> in v1.25+ <code>(spec.os.name != windows)</code></em></p>
<p>Seccomp profile must be explicitly set to one of the allowed values. Both the <code>Unconfined</code> profile and the <em>absence</em> of a profile are prohibited. <em><ahref="#policies-specific-to-linux">This is Linux only policy</a> in v1.25+ <code>(spec.os.name != windows)</code></em></p>
384
+
<p>Seccomp profile must be explicitly set to one of the allowed values. Both the <code>Unconfined</code> profile and the <em>absence</em> of a profile are prohibited. <em><ahref="#OS-specific policy controls">This is Linux only policy</a> in v1.25+ <code>(spec.os.name != windows)</code></em></p>
Containers must drop <code>ALL</code> capabilities, and are only permitted to add back
410
-
the <code>NET_BIND_SERVICE</code> capability. <em><ahref="#policies-specific-to-linux">This is Linux only policy</a> in v1.25+ <code>(.spec.os.name != "windows")</code></em>
410
+
the <code>NET_BIND_SERVICE</code> capability. <em><ahref="#OS-specific policy controls">This is Linux only policy</a> in v1.25+ <code>(.spec.os.name != "windows")</code></em>
0 commit comments