Container Security

Container security covers the full lifecycle of OCI-compatible containers (Docker, containerd, CRI-O). At build time, teams scan images for CVEs and embedded secrets, sign them with Sigstore/Cosign, and enforce minimal base images. At distribution, registries are protected with authenticated access and signature verification. At runtime, host hardening, namespace/cgroup isolation, seccomp, AppArmor, and read-only file systems reduce attack surface, while admission controllers and eBPF-based sensors enforce policy and detect anomalies. Common risks include privileged containers, hostPath mounts, vulnerable base layers, leaked credentials, and container escape via kernel exploits.