You want to block privileged containers from being executed in your Kubernetes cluster.

To blockprivileged containers before they are executed, CrowdStrike recommends deploying theKubernetes Admission Controller. This component operates atadmission time, intercepting Kubernetes API requests and enforcing security policies before workloads are allowed to run.

Privileged containers represent a significant security risk because they can bypass isolation boundaries and access host resources. The Kubernetes Admission Controller can enforce policies that explicitly deny deployments using privileged flags, hostPath mounts, or other high-risk configurations.

Other options do not provide enforcement. Runtime sensors and agents can detect or alert on risky behaviorafter execution, but they cannot prevent the workload from starting. Image assessment evaluates image content but does not enforce Kubernetes runtime constraints.

Therefore, to proactively block privileged containers, the correct and CrowdStrike-recommended solution is theKubernetes Admission Controller.