Securus Mind | Application Security Platform

As containerization becomes the default deployment model for modern applications, securing containers, images, and orchestration platforms is no longer optional—it's mission-critical. This guide covers essential security controls for containerized workloads in 2026.

The Container Security Challenge

Containers introduce unique security considerations:

Key Risk Areas

Vulnerable Base Images: 60% of container images have at least one critical vulnerability (2025 data)
Overprivileged Containers: Running as root unnecessarily expands attack surface
Supply Chain Attacks: Malicious images from untrusted registries
Runtime Exploits: Container escape vulnerabilities in runtimes (Docker, containerd)
Secrets Exposure: Hardcoded credentials in image layers
Network Segmentation: Flat container networks allow lateral movement

1. Secure Container Images

Choose Minimal Base Images

Smaller images = smaller attack surface. Use distroless or Alpine-based images.

Example Dockerfile (Secure):

# Use minimal base image
FROM gcr.io/distroless/nodejs18-debian11

# Non-root user
USER nonroot:nonroot

# Copy only production dependencies
COPY --chown=nonroot:nonroot package*.json ./
COPY --chown=nonroot:nonroot dist/ ./dist/

# Run application
CMD ["dist/server.js"]

Scan Images for Vulnerabilities

Scanning Best Practices:

Scan Early: Integrate scanning into CI/CD before image push
Fail Builds: Block images with critical/high CVEs from reaching production
Re-scan Regularly: Weekly scans of registry images for newly disclosed CVEs
Use Multiple Scanners: Trivy + Snyk/Anchore for broader coverage

Example GitHub Actions Scan:

- name: Scan Image with Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:latest'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    
- name: Fail on Critical Findings
  run: |
    CRITICAL_COUNT=$(jq '[.runs[].results[] | select(.level=="error")] | length' trivy-results.sarif)
    if [ $CRITICAL_COUNT -gt 0 ]; then exit 1; fi

Sign and Verify Images

Use Sigstore/Cosign to cryptographically sign images and prevent tampering.

Example Image Signing:

# Sign image after build
cosign sign --key cosign.key myregistry.io/myapp:v1.2.3

# Verify signature before deployment
cosign verify --key cosign.pub myregistry.io/myapp:v1.2.3

# Kubernetes admission controller enforces verification
# (using Sigstore Policy Controller or Kyverno)

2. Runtime Security Controls

Run Containers as Non-Root

Never run containers as root unless absolutely necessary. Use explicit USER directives.

Kubernetes Pod Security:

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
          - ALL

Enable AppArmor/SELinux

Use mandatory access control (MAC) systems to restrict container capabilities.

Resource Limits

Set CPU and memory limits to prevent DoS attacks from runaway containers.

Example Resource Limits:

resources:
  requests:
    memory: "256Mi"
    cpu: "500m"
  limits:
    memory: "512Mi"
    cpu: "1000m"

3. Network Segmentation

Implement Network Policies

Use Kubernetes NetworkPolicies or service mesh policies to enforce zero-trust networking.

Example Network Policy (Default Deny):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

4. Secrets Management

Never Store Secrets in Images!

Secrets in Docker layers persist even if you delete the files later. Always use external secret stores.

Recommended Secret Management:

Kubernetes Secrets: Minimum baseline (enable encryption at rest)
HashiCorp Vault: Industry standard, dynamic secrets, audit logging
AWS Secrets Manager: Cloud-native, automatic rotation
Azure Key Vault: Integrated with AKS
External Secrets Operator: Sync secrets from external vaults to K8s

5. Runtime Threat Detection

Deploy runtime security monitoring to detect container escape attempts, malicious processes, and anomalous behavior.

Key Capabilities to Monitor:

Processes spawned inside containers (e.g., reverse shells, crypto miners)
File system modifications (e.g., writing to /etc/passwd)
Network connections (e.g., connections to known C2 servers)
Privilege escalation attempts
Container escape exploits (e.g., CVE-2019-5736)

Popular Runtime Security Tools:

Falco: Open-source, eBPF-based runtime threat detection
Sysdig Secure: Commercial, comprehensive container security platform
Aqua Security: Full-stack container security (image scan + runtime)
Prisma Cloud (Palo Alto): Cloud-native security with container support

6. Kubernetes-Specific Hardening

Essential Kubernetes Security Controls

1. Enable Pod Security Standards

Use built-in Pod Security Admission (replaces PSP) to enforce baseline/restricted profiles

2. RBAC Least Privilege

Grant minimum necessary permissions; avoid cluster-admin role

3. Audit Logging

Enable Kubernetes audit logs, ship to SIEM for threat detection

4. Secrets Encryption at Rest

Configure etcd encryption provider for Kubernetes Secrets

5. API Server Hardening

Disable anonymous auth, enable admission controllers (PodSecurity, NodeRestriction)

6. Regular Version Updates

Stay within N-2 supported versions, patch CVEs promptly

Container Security Checklist

Build Phase

✓ Use minimal base images (distroless/Alpine)
✓ Scan images for vulnerabilities (Trivy/Snyk)
✓ No secrets in image layers
✓ Sign images with Sigstore/Cosign
✓ Use multi-stage builds to reduce size
✓ Specify non-root USER in Dockerfile

Deploy Phase

✓ Enforce Pod Security Standards (restricted)
✓ Run as non-root (runAsNonRoot: true)
✓ Drop all capabilities, add only needed ones
✓ Read-only root filesystem where possible
✓ Set resource requests/limits
✓ Verify image signatures before deployment

Runtime Phase

✓ Network policies (default deny)
✓ Runtime threat detection (Falco)
✓ Secrets from external vault
✓ Service mesh mTLS (Istio/Linkerd)
✓ Container runtime security (gVisor/Kata)
✓ Audit logging enabled

Maintain Phase

✓ Re-scan registry weekly for new CVEs
✓ Patch container runtime/orchestrator
✓ Rotate secrets regularly
✓ Review RBAC permissions quarterly
✓ Update base images monthly
✓ Incident response drills (container escape)

Secure Your Container Workloads with Securus Mind

Automated container scanning, runtime protection, and Kubernetes security hardening—all in one platform.

Request Demo Learn More

Container Security Best Practices for 2026