# Process Containment

> Restrict container privileges using security contexts and pod security policies

- **Category**: Cloud
- **Subcategory**: Security
- **Canonical URL**: https://designpattern.fyi/patterns/k8s_process_containment/

---

## Description
The Process Containment pattern restricts container privileges using security contexts and pod security policies. This includes running containers as non-root users, dropping capabilities, restricting filesystem access, and limiting system calls. This improves security by implementing the principle of least privilege.


## Use Cases
Use when you need to restrict container privileges or when you want to implement security best practices for container isolation.





## Trade-offs


### Advantages

- Improved security through least privilege

- Reduces attack surface

- Prevents privilege escalation

- Supports compliance requirements




### Considerations & Drawbacks

- May not work with all applications

- Requires security knowledge

- Can be complex to configure correctly







---
**Reference**: [Original Source](https://github.com/k8spatterns/examples/tree/master/security/ProcessContainment)