Container Security
Securing containers requires a multi-layered approach: secure images, secure registries, secure orchestration, and secure runtime environments.
Security Layers
┌──────────────────────────────────────┐
│ Container Security │
├──────────────────────────────────────┤
│ 1. Image Security │
│ - Minimal base images │
│ - No root user │
│ - Scan for vulnerabilities │
├──────────────────────────────────────┤
│ 2. Registry Security │
│ - Image signing │
│ - Access control │
│ - Vulnerability scanning │
├──────────────────────────────────────┤
│ 3. Orchestrator Security │
│ - RBAC │
│ - Network policies │
│ - Pod security standards │
├──────────────────────────────────────┤
│ 4. Runtime Security │
│ - Read-only filesystem │
│ - No privileged containers │
│ - Resource limits │
└──────────────────────────────────────┘
Secure Dockerfile
# Use minimal base image
FROM node:20-alpine
# Don't run as root
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY --chown=appuser:appgroup . .
USER appuser
EXPOSE 3000
CMD ["node", "server.js"]
Kubernetes Security
# Pod Security Context
apiVersion: v1
kind: Pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
containers:
- name: app
image: myapp:latest
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
resources:
limits:
memory: "128Mi"
cpu: "500m"
Security Tools
- Trivy — Scan container images for vulnerabilities
- Snyk — Find and fix vulnerabilities in dependencies
- Falco — Runtime threat detection for Kubernetes
- OPA/Gatekeeper — Policy enforcement for Kubernetes