Kubernetes user mode in production
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/


  With Linux capabilities, you can grant certain privileges to a process
  without granting all the privileges of the root user. To add or remove
  Linux capabilities for a Container, include the capabilities field in
  the securityContext section of the Container manifest.


In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.

There is an open issue:

https://github.com/kubernetes/kubernetes/issues/7961