9 — Sandboxed Containers (gVisor, Kata)

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

4 — AppArmor

AppArmor confines a process with path-based file, network, and capability rules rather than syscall filtering, and since Kubernetes 1.30 it is configured as a first-class securityContext field instead of only through legacy annotations.

6 — Capabilities

Linux capabilities split root's monolithic power into roughly forty discrete privileges, so dropping ALL and adding back only what's needed, like NET_BIND_SERVICE, is a far narrower grant than running the container as root.

7 — Linux Kernel Isolation

Containers isolate processes using namespaces and cgroups on a single shared host kernel rather than virtualizing hardware, so a kernel-level exploit inside one container can compromise every other container scheduled on that node.

1 — Pod Security Standards

Pod Security Standards replaced the removed PodSecurityPolicy admission controller with three built-in profiles (Privileged, Baseline, Restricted) enforced declaratively via namespace labels.