Not when I can read the root filesytem if mknod privilege isn't dropped, update firmware on the EFI partition, load kernel modules in the host namespace etc....

Not when I can read the root filesytem if mknod privilege isn't dropped, update firmware on the EFI partition, load kernel modules in the host namespace etc.... But it is really about the order namespaces start with almost no isolation and you add whatever you want. Sandboxes and Jails tend to start more restricted by default. As an example here is an older step by step example of the above. Note how disabling privileged containers at the docker server layer is still not possible as they decided user namespaces were their solution. https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities/44100971#44100971 https://stackoverflow.com/questions/36425230/privileged-cont...