Skip to main content

Containers

Container security from both offensive and defensive perspectives. Covers container isolation, attack surface, runtime security, image security, and orchestration security. Containers share the host kernel, which makes the isolation boundary fundamentally different from virtual machines.

Format​

Two-track (Offensive / Defensive). Every file covers both the attack path and the corresponding detection and prevention controls.

Scope​

  • Container isolation internals (namespaces, cgroups, capabilities, LSMs).
  • Container attack surface (Docker, containerd, Podman).
  • Image supply chain security (base images, layers, registries).
  • Container runtime security (seccomp, AppArmor, SELinux).
  • Kubernetes security (pod security, network policies, RBAC).
  • Container escape (covered in detail in 02 VM Escape).

Files​

#FileFormat
01Container FundamentalsTwo-track
02Container Attack SurfaceTwo-track
03Image and Supply Chain SecurityTwo-track
04Container Runtime SecurityTwo-track
05Kubernetes SecurityTwo-track

Certification Alignment​

  • Cloud Native: CKA, CKS (Kubernetes security).
  • Vendor: Docker Certified Associate.
  • Offensive Security: OSCP (container escape context).

References​