Container Security
Container security protects containerized workloads throughout their lifecycle: securing images at build time, hardening runtime isolation, restricting capabilities, segmenting network access, and monitoring for anomalous behavior in production container environments.
itVirtualization, containers, and orchestration | OpenSkills.info
Intro
Container Security
Container security reduces the chance that a compromised image or process can damage its host, neighboring workloads, data, or delivery pipeline. It covers the full container lifecycle. That lifecycle starts with a base image and ends with a running workload that you monitor and replace.
A container packages an application with its user-space dependencies. On Linux, its processes still use the host kernel. Namespaces separate views of resources. Control groups limit resource use. Capabilities and security modules restrict what processes can do. These controls create useful isolation, but they do not turn a container into a separate machine.
That shared-kernel model shapes every security decision. A vulnerable application can become an entry point. Excessive container privileges can turn that entry point into host access. A vulnerable host kernel can weaken isolation for every container on that host.
Think in lifecycle layers
Use five layers as your mental model:
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/190/final
Supports
- Containers as operating system virtualization combined with application packaging
- Shared-kernel isolation and container-specific risks
- Security responsibilities across images, registries, orchestrators, containers, and hosts
- Vulnerability management, trusted images, runtime defense, monitoring, and incident response
- https://docs.docker.com/build/building/best-practices/
Supports
- Trusted minimal base images and reduced attack surface
- Multi-stage builds and removal of build-only content from final images
- Regular image rebuilds with updated dependencies
- Mutable tags, digest pinning, reproducibility, and required update workflows
- https://docs.docker.com/engine/security/
Supports
- Docker daemon authority and host security boundary
- Linux capability removal and least-privilege recommendations
- User namespaces, image signature verification, AppArmor, and SELinux
- https://docs.docker.com/engine/security/seccomp/
Supports
- Seccomp as a Linux system-call restriction mechanism
- Docker default seccomp profile behavior and the risk of unconfined execution
- https://docs.docker.com/engine/security/trust/
Supports
- Image signing and client-side signature enforcement
- Distinction between signed tags and explicit content hashes
- https://kubernetes.io/docs/concepts/security/application-security-checklist/
Supports
- Non-root execution, blocked privilege escalation, read-only root filesystems, and capability removal
- Per-workload service accounts and optional token mounting
- NetworkPolicy enforcement dependency and runtime isolation choices
- https://kubernetes.io/docs/concepts/security/security-checklist/
Supports
- Secret encryption, runtime delivery, and service-account token minimization
- Minimal images, unprivileged users, audit logs, node separation, and RuntimeClass tradeoffs
- https://kubernetes.io/docs/concepts/security/pod-security-standards/
Supports
- Privileged, Baseline, and Restricted policy profiles
- Restricted non-root, privilege-escalation, seccomp, capability, and volume rules
- https://kubernetes.io/docs/concepts/security/linux-kernel-security-constraints/
Supports
- Seccomp, AppArmor, SELinux, capabilities, and non-root workload isolation
- Privileged containers overriding or weakening kernel security constraints
- Sandboxed runtimes as a stronger but more costly isolation choice
- https://specs.opencontainers.org/image-spec/descriptor/
Supports
- OCI descriptor digest and size fields
- Digests as content identifiers and verification inputs
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
Supports
- Risk of exposing the Docker daemon socket
- Capability minimization, security profiles, secret handling, and supply-chain controls