Container security

In short: Containers share the kernel with the host, so their isolation is weaker than with virtual machines. Security comes from minimal images, few privileges and runtime restrictions.

In more detail: A container escape can endanger the host. So: as few privileges as possible, small attack surface, current base images and monitoring.

In Depth

• Do not run as root: Own user in the container, rootless mode.
• Drop capabilities: Only necessary Linux capabilities (for example --cap-drop=ALL).
• Read-only file system and no-new-privileges.
• Minimal images: Distroless/Alpine/scratch, multi-stage builds, fewer packages = fewer holes.
• Image scans: Trivy, Grype find known vulnerabilities.
• Secrets: Never bake into the image, supply at run time via secret manager/environment.
• Network segmentation: NetworkPolicies, no exposed Docker socket.
• Seccomp/AppArmor: Restrict system calls.
• Signed images and trusted registries.

See also: Container internals: namespaces and cgroups, Software supply chain and SBOM