5 — SELinux
Purpose
[stub: selinux]
Metadata
| Author | Amit Singh |
| Scope | kubernetes |
Local graph
Linked from 2 notes
Kubernetes
A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.
Operating Systems for MAANG Interviews
A book-shaped table of contents for operating systems at MAANG interview depth: foundations through processes, threads, concurrency, CPU scheduling, memory management, file systems, I/O, security & isolation, Linux internals, cloud/Kubernetes/observability, advanced kernel topics, and interview preparation — cross-linking existing sre/linux-networking, kubernetes-security, and patterns/concurrency notes instead of duplicating them.
Related notes
4 — AppArmor
AppArmor confines a process with path-based file, network, and capability rules rather than syscall filtering, and since Kubernetes 1.30 it is configured as a first-class securityContext field instead of only through legacy annotations.
6 — Capabilities
Linux capabilities split root's monolithic power into roughly forty discrete privileges, so dropping ALL and adding back only what's needed, like NET_BIND_SERVICE, is a far narrower grant than running the container as root.
7 — Linux Kernel Isolation
Containers isolate processes using namespaces and cgroups on a single shared host kernel rather than virtualizing hardware, so a kernel-level exploit inside one container can compromise every other container scheduled on that node.
1 — Pod Security Standards
Pod Security Standards replaced the removed PodSecurityPolicy admission controller with three built-in profiles (Privileged, Baseline, Restricted) enforced declaratively via namespace labels.