Container Security: Image Hardening and Runtime Protection

Containers package application code and its dependencies into isolated units that share the host OS kernel, unlike VMs which include a full guest OS. This sharing makes containers lightweight and fast, but introduces a different security model: a container escape vulnerability could allow an attacker to break out of the container and access the host kernel directly, affecting all other containers. Container security focuses on three layers: the image (what is baked in), the runtime (what the container can do while running), and the orchestration platform (how containers are managed).

Every package installed in a container image is a potential attack surface. The principle of minimal base images means starting from the smallest possible foundation: Alpine Linux (5MB, minimal packages), distroless images (Google's images that contain only the runtime and application, no shell or package manager), or scratch (completely empty, for statically compiled binaries). A container with no shell means an attacker who achieves code execution cannot easily run wget, curl, or other tools to escalate their attack — a principle called defense through minimal exposure.