Container Security

This roadmap covers securing containers from build to runtime: images, registries, isolation, secrets and monitoring. You should be comfortable with Linux and have Docker installed.

• Install Docker in a lab VM
• Know basic docker build and run commands
• Plan your study time

• CyberA4U Academy — courses

Containers share the host kernel, so risks include vulnerable images, over-privileged containers, exposed daemons, leaked secrets and weak orchestration. NIST SP 800-190 describes the main risk areas.

• List the major container risk areas
• Understand what isolation containers do and don't provide
• Identify controls for each risk

الأدوات والتقنيات: Containers

تعلّمها على CyberA4U:Module 21: Cloud Environment Attack Techniques

• NIST SP 800-190 — Application Container Security Guide

Secure images start with the Dockerfile: small base images, pinned versions, non-root users, no secrets, and multi-stage builds.

• Choose minimal base images
• Run as a non-root user
• Use multi-stage builds to drop build tools

الأدوات والتقنيات: Containers

• Docker — Building best practices

Image scanners find known vulnerabilities and misconfigurations in images before they are deployed.

• Scan images with a tool such as Trivy
• Prioritize fixable, high-severity findings
• Fail builds on agreed thresholds

الأدوات والتقنيات: Containers

• Trivy — vulnerability scanner (GitHub)

Registries store images; signing proves an image came from your build and wasn't changed. Only trusted, signed images should reach production.

• Secure registry access
• Sign images with Cosign
• Verify signatures before deployment

الأدوات والتقنيات: Containers

• Sigstore — Signing containers with Cosign

Containers should run with the least privilege possible: non-root, read-only filesystems, no privileged mode, and limited resources.

• Avoid --privileged and host mounts
• Use read-only root filesystems
• Set CPU and memory limits

الأدوات والتقنيات: Containers

• Docker — Rootless mode

Linux capabilities and seccomp profiles limit what a containerized process can ask the kernel to do.

• Drop all capabilities and add back only what's needed
• Understand Docker's default seccomp profile
• Test an application with reduced privileges

الأدوات والتقنيات: Containers

• Docker — Seccomp security profiles
• capabilities(7) — Linux manual page

Secrets baked into images or environment variables leak easily. Use build secrets and runtime secret stores instead.

• Keep secrets out of image layers
• Use build-time secret mounts
• Load runtime secrets from a secret manager

الأدوات والتقنيات: Containers

• Docker — Build secrets

At runtime, watch for unexpected processes, shells, network connections and file changes inside containers. Tools like Falco detect these using kernel events.

• Recognize suspicious runtime behavior
• Deploy runtime detection
• Tune rules to reduce noise

الأدوات والتقنيات: Containers

• Falco documentation

When containers run on Kubernetes, new controls appear: RBAC, network policies, admission control and pod security. Container hardening and cluster hardening must work together.

• Know which controls belong to the image, runtime and cluster
• Avoid duplicating or missing controls
• Plan the move to the Kubernetes Security roadmap

الأدوات والتقنيات: Containers

• Kubernetes — Security overview

Container security checks belong in CI: lint Dockerfiles, scan images, sign artifacts and block risky builds automatically.

• Add scanning and signing to a pipeline
• Define pass/fail policies
• Protect the pipeline itself

الأدوات والتقنيات: Containers

• OWASP Top 10 CI/CD Security Risks

Containers are short-lived, so responders must capture evidence quickly: image digest, container filesystem changes, logs and the host's view of the process.

• Preserve container evidence before restarting
• Identify the image and deployment involved
• Rebuild from a clean image

الأدوات والتقنيات: Containers

• NIST SP 800-190 — Application Container Security Guide

Pull everything together with a checklist such as the OWASP Docker Security Cheat Sheet and the CIS Docker Benchmark.

• Apply a hardening checklist to a host and its containers
• Record exceptions with reasons
• Re-test regularly

الأدوات والتقنيات: Containers

• OWASP Docker Security Cheat Sheet
• CIS Docker Benchmark

Check that you can build, ship and run a container securely, and respond if something goes wrong.

• Harden an image and runtime
• Scan and sign in CI
• Detect suspicious runtime behavior

• CyberA4U CTF Arena — practice challenges

You can now secure containers end to end. Continue with the Kubernetes Security or DevSecOps Pipeline roadmaps.

• Keep a hardened base image
• Choose your next roadmap
• Share a before/after image comparison

• CyberA4U CTF Arena — practice challenges