Container Security: Scenario-Based Questions

Containers offer portability and consistency, but they also introduce new attack surfaces. Securing containers requires layered controls across images, runtimes, registries, and orchestrators like Kubernetes.

🔐 Image Security

• Use minimal base images (e.g., Alpine, Distroless) to reduce the attack surface.
• Pin versions and verify SHA digests for reproducibility and trust.
• Scan images for vulnerabilities using tools like Trivy, Grype, or Clair.
• Digitally sign images (e.g., Cosign, Notary) and enforce verification at deploy time.

🧱 Runtime Hardening

• Run containers as non-root users — drop privileges in Dockerfiles and entrypoints.
• Use read-only file systems and limit capabilities (e.g., drop NET_RAW).
• Apply seccomp, AppArmor, or SELinux profiles for syscall filtering.
• Scan running containers for drift from known-good images.

🎯 Kubernetes Security (If Orchestrated)

• Use namespaces and NetworkPolicies to isolate workloads.
• Restrict pod privilege escalation (PodSecurityPolicies or OPA/Gatekeeper).
• Monitor API server access and RBAC usage.
• Use admission controllers to enforce compliance.

📦 Registry & Supply Chain

• Use private registries with access control (e.g., ECR, GCR, Harbor).
• Audit registry activity and prevent unauthorized pushes or pulls.
• Integrate SBOM (Software Bill of Materials) into CI/CD pipelines.

✅ Best Practices

• Automate image scanning and policy checks in CI/CD workflows.
• Monitor container activity with runtime tools (e.g., Falco, Sysdig Secure).
• Log all container lifecycle events — creation, exec, network activity.

🚫 Common Pitfalls

• Running containers with full privileges or host mounts.
• Using outdated or unverified public images from Docker Hub.
• Skipping vulnerability scans for base layers or third-party components.

📌 Real-World Insight

Container security is a team sport — developers, platform engineers, and security teams must collaborate across build, ship, and run phases. Shift-left scanning and runtime enforcement are key to defense-in-depth.