Container Security

Advanced ⭐ 120 XP ⏱ 18 min #security#containers#kubernetes

Secure the container lifecycle — images, runtime, and the Kubernetes platform.

📖Theory

Container security spans the whole lifecycle — build, ship, run:

Image — use minimal/distroless bases, scan for CVEs, pin digests, and sign images; never bake secrets into layers
Runtime — run as non-root, drop Linux capabilities, read-only root filesystem, no --privileged, resource limits to prevent noisy-neighbor abuse
Kubernetes — RBAC least privilege, NetworkPolicies to restrict pod-to-pod traffic, Pod Security Standards, and admission controllers (OPA/Kyverno) to enforce policy

Containers share the host kernel, so a container escape is serious — defense in depth across all three layers matters.

🌍Real-World Example

FROM gcr.io/distroless/static    # minimal base, no shell
USER 10001                       # non-root
COPY --chown=10001 app /app
ENTRYPOINT ["/app"]

# Kubernetes hardening
securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities: { drop: ["ALL"] }

✍️Hands-On Exercise

List three ways to harden a container image.
Write a Kubernetes securityContext that runs non-root and read-only.
Explain what a NetworkPolicy restricts.
Why is a container escape more dangerous than a VM escape?

🧾Cheat Sheet▾

Layer	Controls
Image	Minimal base, scan, sign, no secrets
Runtime	Non-root, drop caps, read-only FS
Avoid	`--privileged`, root user
Kubernetes RBAC	Least privilege
NetworkPolicy	Restrict pod traffic
Pod Security	Enforce standards
Admission control	OPA / Kyverno policies

💬Common Interview Questions▾

Why should containers not run as root?

Containers share the host kernel, so a compromised root container is much closer to compromising the host. Running non-root and dropping capabilities limits the damage.

What does a Kubernetes NetworkPolicy do?

It restricts which pods can communicate, on which ports — replacing the default allow-all pod network with explicit allow rules to limit lateral movement.

How do you secure a container image?

Use a minimal/distroless base, scan for vulnerabilities, pin and sign images, run as non-root, and keep secrets out of the layers.

📚Official Documentation

↗ NIST — Application Container Security Guide (SP 800-190)

📝 My notes on this topic

Auto-saves as you type