# What is Container Security?

> Container security is the set of practices and controls used to protect container images, registries, runtimes, orchestrators, host systems, networks, identities, secrets, and delivery pipelines throughout the container lifecycle.

- Canonical URL: https://yellowcube.eu/glossary/container-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It begins before an image is built and continues through deployment, operation, incident response, and retirement. It is not limited to scanning an image for known software vulnerabilities.

Containers normally provide operating-system-level isolation and share the host kernel, unlike virtual machines with separate guest kernels. Their security therefore depends on both the container configuration and the surrounding platform. A privileged container, dangerous host mount, exposed orchestrator API, compromised registry, or vulnerable node can undermine otherwise well-built application code.

### Key points

- **Secure the supply chain:** Use minimal maintained base images, pin and verify dependencies, protect build systems and registries, produce provenance, scan artifacts, and rebuild when fixes become available.
- **Harden deployment:** Run as a non-root user, drop unnecessary Linux capabilities, restrict privilege escalation and host access, use read-only filesystems where practical, and enforce resource and admission policies.
- **Protect the platform:** Limit orchestrator and node administration, apply RBAC and workload identities, segment network paths, protect secrets and control-plane data, and keep hosts and runtime components patched.
- **Monitor and respond:** Record deployment and audit events, detect unexpected processes, files, connections, or privilege changes, preserve useful evidence, and replace compromised workloads from trusted artifacts.
- **Important limitation:** A container is not automatically a strong security boundary. Shared-kernel flaws, privileged modes, weak policy, exposed management interfaces, or unsafe host integration can enable escape or broader platform compromise.

### Related terms

[Kubernetes security](<https://yellowcube.eu/glossary/kubernetes-security/>) · [Cloud workload protection platform (CWPP)](<https://yellowcube.eu/glossary/cloud-workload-protection-platform/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>) · [DevSecOps](<https://yellowcube.eu/glossary/devsecops/>)

### Sources

[NIST SP 800-190: Application Container Security Guide](https://csrc.nist.gov/pubs/sp/800/190/final) · [Kubernetes Security Checklist](https://kubernetes.io/docs/concepts/security/security-checklist/) · [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.