Container Security

Container Security

What I Do

I provide guidance on securing containerized workloads from image build through runtime. This includes writing secure Dockerfiles, scanning images for vulnerabilities, configuring Kubernetes security policies, implementing runtime monitoring, and establishing supply chain integrity for container images.

When to Use Me

• Writing secure Dockerfiles with minimal attack surface
• Scanning container images for CVEs and misconfigurations
• Configuring Kubernetes Pod Security Standards and network policies
• Implementing image signing and verification workflows
• Setting up runtime anomaly detection for containers
• Hardening container orchestration platforms

Core Concepts

1. Minimal Base Images: Use distroless or scratch images to reduce attack surface and vulnerability count.
2. Non-Root Execution: Run containers as non-root users to limit the impact of container escape vulnerabilities.
3. Image Scanning: Scan images for known CVEs in OS packages and application dependencies before deployment.
4. Image Signing: Sign images with cosign or Notary and verify signatures before deployment.
5. Pod Security Standards: Apply Kubernetes restricted, baseline, or privileged profiles to control pod capabilities.
6. Network Policies: Use Kubernetes NetworkPolicy to restrict pod-to-pod and pod-to-external communication.
7. Read-Only Filesystems: Mount container filesystems as read-only and use tmpfs for writable directories.
8. Resource Limits: Set CPU and memory limits to prevent denial-of-service from runaway containers.

Code Examples

1. Secure Multi-Stage Dockerfile

FROM python:3.11-slim AS builder
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --target=/deps -r requirements.txt

FROM gcr.io/distroless/python3-debian12
WORKDIR /app
COPY --from=builder /deps /deps
COPY src/ /app/
ENV PYTHONPATH=/deps
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["python3", "main.py"]

2. Kubernetes Pod Security Context

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534
    fsGroup: 65534
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: registry.example.com/app:v1.2.3@sha256:abc123...
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      resources:
        limits:
          memory: "256Mi"
          cpu: "500m"
        requests:
          memory: "128Mi"
          cpu: "250m"
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir:
        medium: Memory
        sizeLimit: "64Mi"

3. Kubernetes Network Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

Best Practices

1. Use minimal base images (distroless, scratch, alpine) to reduce attack surface.
2. Run as non-root and drop all Linux capabilities except those explicitly required.
3. Pin image digests (sha256) instead of mutable tags for reproducible deployments.
4. Scan images in CI/CD with Trivy, Grype, or Snyk and fail builds on critical CVEs.
5. Enable read-only root filesystems and use emptyDir volumes for temporary files.
6. Set resource limits on all containers to prevent resource exhaustion attacks.
7. Apply network policies to restrict communication to only required paths.
8. Sign and verify images using cosign with keyless signing via Sigstore.
9. Use Pod Security Standards at the namespace level with restricted profile for production.
10. Never mount the Docker socket or Kubernetes service account tokens unless explicitly needed.