Run pods in Linux user namespaces
To enhance container security and reduce the impact of a container breakout, you can isolate pod processes by using Linux user namespaces. Containers can then run with administrative privileges inside the namespace while remaining unprivileged on the host system.