Runtime security

- Privilege escalation paths (node to cluster) - Container escape vectors (docker.sock, hostPath, capabilities) - eBPF runtime detection (Falco, Tetragon, Tracee) - Admission controller bypasses