// 1) run as Privileged
  // 2) has CAP_SYS_ADMIN
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional bool allowPrivilegeEscalation = 7;

  // procMount denotes the type of proc mount to use for the containers.
  // The default is DefaultProcMount which uses the container runtime defaults for
  // readonly paths and masked paths.