An image can specify a nonroot runtime user, and Kubernetes can add container security settings. These controls address different boundaries. runAsNonRoot constrains identity, allowPrivilegeEscalation controls privilege gain and dropping Linux capabilities removes selected kernel privileges. None of them replaces application authentication or fixes vulnerable code. Also keep credentials out of image layers and environment defaults, where an image inspector can read them. The tasks first prepare a fictional nonroot release image, then configure a Pod template with separate privilege controls. Check every requested field: setting a numeric user alone leaves the other security settings unchanged.