Cloud Security
Container Security
Securing container images, registries and runtimes.
- 6 notes
- 48 minutes of reading
- Containers versus virtual machines: images, layers and isolationWhat containers are, how images and layers work, how isolation differs from virtual machines, and why those differences matter for security. 7 min · Beginner
- Container image security: minimal bases, scanning, secrets and pinningPractical ways to build safer container images: choose minimal base images, use multi-stage builds, scan for vulnerabilities and secrets, run as non-root and pin images by digest. 8 min · Intermediate
- Software supply chain for containers: registries, signing, SBOMs and provenanceHow attackers target the path from source code to running container, and how private registries, image signing, software bills of materials (SBOMs) and build provenance help you trust what you deploy. 9 min · Advanced
- Container runtime security: least privilege, read-only filesystems, capabilities and monitoringHow to restrict what a running container can do using non-root users, dropped Linux capabilities, read-only filesystems, seccomp and resource limits, and how to detect suspicious behaviour at runtime. 8 min · Intermediate
- Hardening Docker hosts and daemons: CIS ideas, rootless mode and user namespacesHow to secure the machine and daemon that run your containers, drawing on CIS Docker Benchmark ideas, rootless mode, user namespace remapping, socket protection and auditing. 8 min · Intermediate
- Handling secrets for containers: environment variables, secret stores and rotationHow to supply passwords, API keys and certificates to containers safely, comparing environment variables, mounted files and external secret stores, and how to rotate secrets without downtime. 8 min · Intermediate