🛡️ Container Hardening

Container Hardening is the process of reducing the attack surface of containers by applying security best practices to container images, runtimes, orchestrators, and host systems. The goal is to make containers more resistant to compromise while maintaining functionality.

Core Objective

A hardened container follows the principle of:

“Provide only the minimum software, permissions, and access required to run the application.”

This aligns with the security concepts of:

Least Privilege
Defense in Depth
Secure by Default
Zero Trust

Why Container Hardening Matters

Containers share the host operating system kernel. If an attacker compromises a container, weaknesses in configuration may allow them to:

Escape the container
Access sensitive data
Move laterally to other containers
Compromise the host
Gain cluster-wide control

Proper hardening significantly reduces these risks.

Key Container Hardening Techniques

1. Use Minimal Base Images

Bad

FROM ubuntu:latest

Contains many unnecessary packages.

Better

FROM alpine:3.22

Best

FROM gcr.io/distroless/dotnet

FROM scratch

Benefits:

Smaller attack surface
Fewer vulnerabilities
Faster image downloads
Less software to patch

2. Remove Unnecessary Packages

Avoid installing tools not required by the application.

Avoid

RUN apt-get install -y \
    vim \
    curl \
    net-tools \
    telnet

Better

Install only what is needed:

RUN apt-get install -y ca-certificates

3. Run as Non-Root

Many containers run as root by default.

Bad

FROM nginx

Better

RUN adduser --system appuser

USER appuser

Or in Kubernetes:

securityContext:
  runAsNonRoot: true
  runAsUser: 1001

Benefits:

Limits privilege escalation
Reduces container breakout impact

4. Use Read-Only Filesystems

Most applications do not need to write to the container filesystem.

Kubernetes:

securityContext:
  readOnlyRootFilesystem: true

Benefits:

Prevents malware installation
Protects application binaries

5. Drop Linux Capabilities

Linux capabilities provide privileged actions.

Containers often receive capabilities they do not need.

Example

securityContext:
  capabilities:
    drop:
      - ALL

Add back only required ones:

securityContext:
  capabilities:
    drop:
      - ALL
    add:
      - NET_BIND_SERVICE

Common dangerous capabilities:

SYS_ADMIN
SYS_MODULE
NET_ADMIN
SYS_PTRACE

6. Prevent Privilege Escalation

Kubernetes:

securityContext:
  allowPrivilegeEscalation: false

Prevents processes from gaining additional privileges.

7. Avoid Privileged Containers

Dangerous

securityContext:
  privileged: true

This effectively gives the container host-level access.

Only use when absolutely necessary.

8. Scan Images for Vulnerabilities

Use security scanners to detect:

CVEs
Outdated libraries
Misconfigurations
Secrets

Popular tools:

Trivy
Snyk
Grype
Microsoft Defender for Containers
Docker Scout

Example:

trivy image myapp:latest

9. Sign and Verify Images

Ensure container images are trusted.

Tools:

Cosign
Notary
Sigstore

Example:

cosign sign myapp:1.0

Benefits:

Prevents supply-chain attacks
Verifies image authenticity

10. Keep Images Updated

Avoid:

FROM node:16

if no longer supported.

Regularly:

Update base images
Rebuild containers
Patch dependencies

Automate through CI/CD pipelines.

11. Secure Secrets Management

Never

ENV DB_PASSWORD=SuperSecret123

Use

Kubernetes Secrets
Azure Key Vault
AWS Secrets Manager
HashiCorp Vault

Secrets should never be baked into images.

12. Network Segmentation

Limit communication between containers.

Example Kubernetes Network Policy:

kind: NetworkPolicy
spec:
  podSelector:
  policyTypes:
  - Ingress
  - Egress

Benefits:

Reduces lateral movement
Limits blast radius

13. Resource Limits

Prevent resource exhaustion attacks.

resources:
  requests:
    cpu: "500m"
    memory: "512Mi"
  limits:
    cpu: "1"
    memory: "1Gi"

Protects against:

Denial of Service (DoS)
Runaway processes
Cryptocurrency miners

14. Use Seccomp Profiles

Seccomp restricts Linux system calls.

Example:

securityContext:
  seccompProfile:
    type: RuntimeDefault

Benefits:

Reduces kernel attack surface
Blocks dangerous syscalls

15. Use AppArmor or SELinux

Additional mandatory access controls.

Examples:

AppArmor

container.apparmor.security.beta.kubernetes.io/app: runtime/default

SELinux

securityContext:
  seLinuxOptions:
    level: "s0:c123,c456"

Provides another layer of isolation.

Container Hardening Checklist

Control	Recommendation
Base Image	Use distroless or minimal images
User	Run as non-root
Privileges	Disable privileged mode
Filesystem	Read-only where possible
Capabilities	Drop all unnecessary capabilities
Secrets	Use Vault/Key Vault/K8s Secrets
Image Scanning	Scan for CVEs continuously
Resource Limits	Set CPU and memory limits
Network	Use network policies
Seccomp	Enable RuntimeDefault
AppArmor/SELinux	Enforce policies
Image Signing	Verify trusted images
Updates	Patch and rebuild often

Example: Hardened Kubernetes Pod

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  containers:
  - name: app
    image: myapp:1.0
    securityContext:
      runAsNonRoot: true
      runAsUser: 10001
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault
    resources:
      limits:
        cpu: "1"
        memory: "512Mi"

In summary:

Container Hardening is the practice of securing containerized applications by minimising the attack surface, reducing privileges, and enforcing security controls. Common hardening measures include using minimal base images, running containers as non-root users, removing unnecessary packages, dropping Linux capabilities, enabling Seccomp/AppArmor, scanning images for vulnerabilities, managing secrets securely, and restricting network access. The objective is to prevent container compromise and limit the impact if a breach occurs.