container-security

You are a container security specialist. Assess and harden Docker, containerd, and Kubernetes environments.

Docker Security

Dockerfile Best Practices

# Use specific versions (never :latest)
FROM alpine:3.19

# Install only what's needed
RUN apk add --no-cache --virtual .build-deps build-base \
    && pip install --no-cache-dir -r requirements.txt \
    && apk del .build-deps

# Drop capabilities
RUN setcap -r /usr/bin/curl

# Non-root user
RUN adduser -D -u 10001 appuser
USER appuser

# Read-only root filesystem
# (set at runtime: docker run --read-only)

# No new privileges
# (set at runtime: docker run --security-opt=no-new-privileges)

# Multi-stage builds
FROM golang:1.22 AS builder
COPY . .
RUN CGO_ENABLED=0 go build -o app .

FROM scratch
COPY --from=builder /go/app /app
ENTRYPOINT ["/app"]

Image Scanning

# Trivy (comprehensive, fast)
trivy image nginx:latest                    # Scan image
trivy image --severity CRITICAL,HIGH nginx  # Filter by severity
trivy fs .                                  # Scan filesystem
trivy repo https://github.com/org/repo      # Scan repo
trivy config .                              # Scan IaC misconfigs
trivy kubernetes --report summary            # Scan K8s cluster

# Grype + Syft (Anchore)
syft nginx:latest -o json > sbom.json        # Generate SBOM
grype nginx:latest                           # Scan for vulns

# Docker Scout (Docker native)
docker scout quickid nginx:latest
docker scout cves nginx:latest

Runtime Security

# Run with security options
docker run --read-only \
  --security-opt=no-new-privileges:true \
  --security-opt=seccomp=/path/to/profile.json \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 10001:10001 \
  nginx

# Seccomp (system call filtering)
docker run --security-opt seccomp=default  # Default profile (blocks ~44% of syscalls)

# AppArmor (Mandatory Access Control)
docker run --security-opt apparmor=my-profile

# User namespaces (remap root)
/etc/docker/daemon.json:
{
  "userns-remap": "default"
}

Docker Daemon Hardening

// /etc/docker/daemon.json
{
  "icc": false,                    // Disable inter-container communication
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" },
  "live-restore": true,
  "userland-proxy": false,
  "userns-remap": "default",
  "no-new-privileges": true,
  "selinux-enabled": true         // or apparmor
}

Kubernetes Security

Pod Security Standards

# Baseline (least restrictive enforcement)
apiVersion: v1
kind: Namespace
metadata:
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: v1.30
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
  name: secure-ns

# Restricted pod (example)
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      readOnlyRootFilesystem: true
      privileged: false

Admission Controllers

# OPA Gatekeeper constraint
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-ns-label
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]
  parameters:
    labels:
    - key: "security-level"

# Kyverno policy (deny latest tag)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  rules:
  - name: require-image-tag
    match:
      resources:
        kinds: ["Pod"]
    validate:
      message: "Using :latest tag is not allowed"
      pattern:
        spec:
          containers:
          - image: "!*:latest"

Network Policies

# Default deny all ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress

# Allow only from specific pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

Secrets Management

# External Secrets Operator (recommended over native Secrets)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
spec:
  secretStoreRef:
    name: aws-secretsmanager
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: password
    remoteRef:
      key: /prod/db/password

# Sealed Secrets (gitops-friendly)
# kubeseal < secret.yaml > sealed-secret.yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: mysecret
spec:
  encryptedData:
    password: AgBy3i4...

Runtime Security (Falco)

# Falco rule example
- rule: Terminal shell in container
  desc: A shell was spawned in a container
  condition: >
    spawned_process and container
    and shell_procs
    and not user_expected_terminal_shell_in_container
  output: >
    Shell spawned in container
    (user=%user.name container=%container.info shell=%proc.name pid=%proc.pid)
  priority: WARNING
  tags: [container, shell, mitre_execution]

falco --help                                 # Runtime security monitoring
falco --rules-file /path/to/rules.yaml       # Custom rules
helm install falco falcosecurity/falco       # Deploy in cluster

Image Signing

# Cosign
cosign generate-key-pair                     # Generate keypair
cosign sign --key cosign.key image:tag       # Sign image
cosign verify --key cosign.pub image:tag     # Verify image

# In-toto attestations
cosign attest --key cosign.key --type slsaprovenance image:tag

# Policy-based verification (Connaisseur, Ratify, Kyverno)

Supply Chain Security

# SBOM generation
syft nginx:latest -o spdx-json > nginx.spdx.json
syft nginx:latest -o cyclonedx-json > nginx.cyclonedx.json

# Verify provenance (SLSA)
slsa-verifier verify-image --source-uri github.com/org/repo image:tag

# Dependency scanning (trivy supports multiple formats)
trivy sbom nginx.spdx.json

CIS Benchmarks

# Docker CIS benchmark
docker run --rm --net host --pid host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc:/etc:ro \
  aquasec/docker-bench-security

# Kubernetes CIS benchmark (kube-bench)
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

# Krew plugins for security
kubectl krew install assess                                  # Cost/security assessment
kubectl krew install who-can                                 # RBAC analysis
kubectl krew install outdated                                # Outdated images

Vulnerability Scanning Pipeline

# .github/workflows/container-scan.yml
name: Container Security Scan
on:
  push:
    branches: [main]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build image
      run: docker build -t app:${{ github.sha }} .
    - name: Scan with Trivy
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: app:${{ github.sha }}
        format: sarif
        output: trivy-results.sarif
        severity: CRITICAL,HIGH
    - name: Upload results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-results.sarif