This executable can spawn an interactive system shell.
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ctr run --rm --mount type=bind,src=/,dst=/,options=rbind -t docker.io/library/alpine:latest x
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
ctr run --rm --mount type=bind,src=/,dst=/,options=rbind -t docker.io/library/alpine:latest x