Questions

1. True or false – containers are “lightweight VMs.”
   1. True
   2. False
2. Can a container access resources from its host?
   1. No, it’s isolated.
   2. If marked as privileged, yes.
   3. Only if explicitly granted by a policy.
   4. Sometimes.
3. How could an attacker gain access to a cluster through a container?
   1. A bug in the container’s application can lead to a remote code execution, which can be used in a breakout of a vulnerable container, and it is then used to get the kubelet’s credentials.
   2. Compromised credentials with the ability to create a container in one namespace can be used to create a container that mounts the node’s filesystem to get the kubelet’s credentials.
   3. Both of the above.
4. What mechanism enforces ConstraintTemplates?
   1. An admission controller that inspects all pods...