containers

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.