violates PodSecurity Kubernetes Origin: Platform & cloud Last updated 13 Oct 2026

Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...

The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.

Exact message you may see violates PodSecuritypods is forbidden: violates PodSecurityallowPrivilegeEscalation != falseunrestricted capabilitiesrunAsNonRoot != true
Explore the map of this error Full error map →
Seen on: Kubernetes

Meaning

Pod Security Admission (replacing PodSecurityPolicy since 1.25) checks namespace labels pod-security.kubernetes.io/enforce. “restricted” requires runAsNonRoot, no privilege escalation, dropped capabilities and a seccomp profile.

Common causes

  • Container runs as root or allows privilege escalation
  • Missing seccompProfile / capabilities not dropped
  • hostPath, hostNetwork or privileged containers in a baseline/restricted namespace

⚡ Quick fix

  1. Add the required securityContext
  2. Run the image as a non-root user
  3. Relax the namespace label only if appropriate

Detailed fix by platform

YAML

  1. bash
    securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities: { drop: ["ALL"] }
  seccompProfile: { type: RuntimeDefault }

How to diagnose

  1. Namespace — kubectl get ns app --show-labels
  2. Violations — Listed rules in the message

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

1005 — Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in (Cloudflare)10051006 — Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned (Cloudflare)1006403 Forbidden wp-admin — WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php (WordPress)403 Forbidden wp-adminAADSTS50053 — AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity (Azure)AADSTS50053admission webhook denied the request — Error from server: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request (Kubernetes)admission webhook den…antiforgery token could not be decrypted — ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request) (.NET)antiforgery token cou…CrashLoopBackOff — Kubernetes: CrashLoopBackOff (Kubernetes)CrashLoopBackOffCreateContainerError — Pod status CreateContainerError (Kubernetes)CreateContainerErrorviolates …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.