Container Security Basics
On this page
Containers package applications for portability and speed — and introduce their own security concerns. Because containers share the host’s kernel rather than fully virtualizing, isolation is thinner than a VM, and the convenience of pulling images and layering software creates a real supply-chain and attack-surface problem. Securing containers is mostly about image hygiene and sensible isolation.
What are the main risks?#
| Risk | Why it matters |
|---|---|
| Vulnerable base images | Inherit known CVEs from the start |
| Running as root | A container escape becomes host root |
| Secrets in images | Credentials shipped to anyone with the image |
| Bloated images | More software = more attack surface |
| Weak isolation | Shared kernel; escapes are impactful |
Because the kernel is shared, a container escape can be more damaging than a VM escape — so limiting what a container can do is essential.
How do you address them?#
- Minimal, trusted base images — smaller means fewer vulnerabilities.
- Scan images for known CVEs in your CI/CD pipeline.
- Run as non-root and drop unnecessary Linux capabilities.
- Keep secrets out of images — inject them at runtime.
- Rebuild regularly to pick up patches, and sign images so only trusted ones run.
Container security is hardening applied to modern deployment. See also Kubernetes security and the Defense & Hardening hub.
Frequently asked questions#
What are the main container security risks?
Vulnerable or untrusted base images, running containers as root, weak isolation from the host, secrets baked into images, and an oversized attack surface from unnecessary packages. Because containers share the host kernel, a container escape can be more serious than a VM escape, making image hygiene and isolation critical.
How do you secure container images?
Use minimal, trusted base images; scan images for known vulnerabilities in your pipeline; do not embed secrets in images; run as a non-root user; and rebuild regularly to pick up patches. Signing images and enforcing that only signed, scanned images run adds supply-chain assurance.