Container and Kubernetes Security
Scan images for vulnerabilities, configure Pod Security Standards, and use network policies in Kubernetes.
Container and Kubernetes Security is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Container Security Overview
Containers share the host kernel, making them less isolated than VMs. Container security spans: image hygiene (no vulnerable packages), runtime protection (detecting abnormal behavior), network policy (restricting pod communication), and RBAC configuration.
Image Scanning with Trivy
Trivy scans container images for OS package CVEs, application dependency vulnerabilities, misconfigurations, and secrets. Integrate into CI/CD to block images with critical vulnerabilities before they reach production.
trivy image nginx:latest
trivy image --severity CRITICAL,HIGH myapp:v1.2Dockerfile Best Practices
Use minimal base images (alpine, distroless). Run as non-root user (USER 1000). Avoid COPY . . — be specific. Multi-stage builds reduce final image size. Scan before push. Never hardcode secrets or credentials in layers.
FROM node:18-alpine
RUN addgroup -S app && adduser -S app -G app
USER app
COPY --chown=app:app . .
CMD ["node", "server.js"]Kubernetes RBAC
Kubernetes RBAC controls access to the API server. ClusterRoles and Roles define permissions on resources (pods, secrets, deployments). ClusterRoleBindings and RoleBindings assign them to users, groups, or ServiceAccounts. Avoid cluster-admin except for automation.
Pod Security Standards
PSS defines three profiles: Privileged (unrestricted), Baseline (minimal restrictions), and Restricted (hardened). Apply via PodSecurity admission controller namespace labels. The Restricted profile prevents running as root, disallows privilege escalation, and requires read-only filesystems.
Network Policies
By default, all pods can communicate with all other pods. Kubernetes NetworkPolicies define ingress and egress rules per pod selector. Implement default-deny policies and explicitly allow only required communication paths to limit blast radius.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all
spec:
podSelector: {}
policyTypes: ["Ingress","Egress"]Secrets Management in Kubernetes
Kubernetes Secrets are base64-encoded, not encrypted, by default. Enable encryption at rest for etcd. Use External Secrets Operator or Vault Agent Injector to source secrets from HashiCorp Vault or cloud secrets managers instead of Kubernetes Secrets.
Admission Controllers
Admission controllers intercept API requests before objects are created. OPA/Gatekeeper enforces custom policies (e.g., require specific labels, block privileged containers). Kyverno provides policy-as-code with simpler YAML syntax for common K8s security constraints.
Runtime Security with Falco
Falco detects anomalous behavior at runtime using eBPF: shells spawned in containers, unexpected outbound connections, files written under /etc, privilege escalation attempts, and known attack tool execution. Alert rules are customizable YAML.
Kubernetes Audit Logs
Enable API server audit logging to record every request with user, action, resource, and timestamp. Forward to a SIEM to detect unusual API activity: ServiceAccount token listing, secret enumeration, role escalation, and kubectl exec into production pods.
Supply Chain Security with Cosign
Sign container images with Cosign (Sigstore) to ensure supply chain integrity. Policy controllers (Connaisseur, Kyverno) can enforce that only signed images from trusted registries are admitted into the cluster, blocking untrusted image pulls.
Knowledge Check
What does a Kubernetes NetworkPolicy with an empty podSelector and policyTypes Ingress/Egress accomplish?
Summary
Container and Kubernetes security requires securing the image supply chain, enforcing RBAC and Pod Security Standards, implementing network policies, managing secrets properly, and using runtime detection to catch attacks that bypass preventive controls.
Frequently asked questions
Is the “Container and Kubernetes Security” lesson free?
Yes — the full text of “Container and Kubernetes Security” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Container and Kubernetes Security”?
Scan images for vulnerabilities, configure Pod Security Standards, and use network policies in Kubernetes. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Container and Kubernetes Security” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Cloud IAM: Roles, Policies, and Least Privilege
- Common Cloud Misconfigurations
- Cloud Security Posture Management (CSPM)
- Container and Kubernetes Security