Container Threats
Risks in Docker and images.
Container Threats is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a Container
A container packages an application together with its dependencies so it runs the same way everywhere.
Tools like Docker made containers popular because they start fast and are lightweight compared to virtual machines.
Shared Kernel Risk
Unlike virtual machines, containers on the same host share the operating system kernel.
If an attacker escapes a container, that shared kernel can become a path to the host and to other containers.
Untrusted Images
Many teams pull images from public registries.
An image from an unknown author may contain malware, backdoors, or hidden cryptominers. Always know where an image comes from.
Vulnerable Base Images
Even trusted images can be risky if they are outdated.
A base image built months ago may carry known vulnerabilities in its libraries that were patched long ago upstream.
Secrets Baked Into Images
A common mistake is hardcoding passwords or API keys in an image.
Anyone who pulls the image can read those secrets. Inspecting layers reveals them easily:
docker history myapp:latestRunning as Root
By default, processes inside a container often run as root.
If that process is compromised, the attacker gains root-level power inside the container, making any escape far more dangerous.
Overly Broad Privileges
Flags that grant extra power widen the attack surface.
Running a container in privileged mode removes most isolation:
docker run --privileged myappAvoid this unless absolutely required.
Exposed Ports and Services
Containers often publish network ports.
An unnecessary open port, such as a database exposed to the internet, gives attackers a direct target. Only publish ports you truly need.
Insecure Registries
If images travel over an unencrypted or unauthenticated registry, attackers can tamper with them in transit.
Use trusted registries with TLS and access controls.
Resource Abuse
A container with no limits can consume all CPU and memory on a host.
This causes denial of service for other workloads. Set resource limits to keep one container from starving the rest.
The Big Picture
Container risk spans the whole lifecycle:
- The image you build from
- The registry you pull from
- The privileges you run with
- The host you share
Each stage needs attention.
Quick Check
Why is a container escape often more serious than a VM escape?
Recap
Container threats include untrusted images, outdated base images, baked-in secrets, running as root, privileged mode, exposed ports, and a shared kernel.
Knowing these risks is the first step toward securing your container deployments.
Frequently asked questions
Is the “Container Threats” lesson free?
Yes — the full text of “Container Threats” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Container Threats”?
Risks in Docker and images. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Container Threats” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Container Threats
- Image Scanning
- Runtime Security
- Kubernetes Security Basics