As container adoption continues to surge and cyber-attacks become more sophisticated, securing containerized applications has become a critical task. This is a complex task that involves securing the containerized application and the different tools interacting with the container. However, with a bit of forethought and the right measures in place, you can secure the entire container lifecycle.

In this article, we'll cover some practical security best practices you can implement today to help secure your container infrastructure.

Why Container Security Matters

According to a recent report by Gartner, more than 70% of global organizations were running more than two containerized applications in 2023, up from less than 25% in 2020. This means that container security is not only a technical issue but also a business and compliance issue. If your containers are compromised, you could face data breaches, service disruptions, reputation damage, and legal liabilities.

Therefore, it's essential to embrace a DevSecOps approach, where security is embedded into every phase of the development, deployment, and runtime cycle.

To learn more about container security in general, check out our article Security & Containerization - How to Secure Containers

Container Security

To fully secure your containerized workloads in production, you have to secure the container’s host, image, runtime, registry, and orchestrator.

Host and OS Security

The first step to secure your containers is to secure the underlying host and operating system that runs them. The host and OS provide the foundation for your container stack, and any weakness in them can compromise the entire stack. Here are some of the best practices for host and OS security:

• Use a minimal and dedicated OS for your containers. A minimal OS has fewer packages and features, which reduces the attack surface and the need for patching. A dedicated OS is optimized for running containers and has no other applications or services that could interfere with them. Some examples of minimal and dedicated OSes for containers are CoreOS, RancherOS, and Ubuntu Core.
• Keep your host and OS up to date. Regularly apply security patches and updates to your host and OS to fix any known vulnerabilities and bugs. You can use tools like Ansible or Chef to automate the update process and ensure consistency across your hosts.
• Harden your host and OS configuration. Apply security best practices such as disabling unnecessary services and ports, enforcing strong passwords and encryption, limiting user access and privileges, and enabling firewall and antivirus protection. Tools like CIS Benchmarks or OpenSCAP can help you audit and enforce your configuration settings.‬
• Monitor your host and OS activity. Use Prometheus or Grafana to collect and visualize metrics such as CPU, memory, disk, network, and process usage. Use tools such as Falco or Auditd to detect and alert you on any suspicious or anomalous activity, for instance, unauthorized access, file changes, or system calls.

Container Image Security

The next step to secure your containers is to secure the images used to build them. Here are some of the best practices for container image security:

• Use trusted and verified images. Use images from official repositories or vendors, and verify their authenticity and integrity using digital signatures and checksums. Avoid using images from unknown or untrusted sources, as they may contain malicious code or vulnerabilities.
• Scan your images for vulnerabilities. Scan your images with Clair or Trivy for any known vulnerabilities in the application code, libraries, or packages. Fix any critical or high-severity vulnerabilities before deploying your images to production. Use  Anchore or Snyk to monitor and update your images for any new vulnerabilities.
• Minimize your image size and layers. Use tools like Dockerfile or BuildKit to create efficiently sized images. Minimizing your image size and layers can improve your image performance, portability, and security, as well as reduce the attack surface and the exposure time. Learn more about layers from this blog: What Are Docker Image Layers and How Do They Work?
• Encrypt and protect your image data. Encrypt your image data with strong encryption algorithms and keys using tools like Docker or Podman. This protects your image content from unauthorized access or tampering. Use Vault or Sealed Secrets to secure and manage your image secrets, such as passwords, tokens, or certificates.‬ 

Container Runtime Security

The third step to secure your containers involves securing the runtime that runs them. Here are some of the best practices for container runtime security:

• Use a secure and compatible runtime. Use a runtime that supports the security features and standards that you need for your containers, such as namespaces, cgroups, seccomp, apparmor, SELinux, or OCI. Some examples of secure and compatible runtimes are Docker, CRI-O, and containerd.
• Limit your container privileges and resources. Use tools like Docker or Kubernetes to limit the privileges and resources such as the network, filesystem, memory, CPU, or devices that your containers can access and use. This can prevent privilege escalation, resource exhaustion, or denial-of-service attacks. You can also use tools like gVisor or Kata Containers to isolate your containers using sandboxing techniques, such as virtualization or user-space kernels.

Container Registry Security

The fourth step is to secure the container registry storing your images. Here are some of the best practices for container registry security:

• Use a private and secure registry. Use a registry that offers the security and compliance features that you need for your containers, such as encryption, authentication, authorization, auditing, or scanning. Some examples of private and secure registries include Docker Hub, Harbor, and Quay.
• Control your registry access and permissions. Implement authorization to control who has access to your registry and what they can do with the images. Additionally, implement multi-factor authentication to provide an extra layer of security for your registry.
• Backup and replicate your registry data. Use backup tools like Velero or Rsync to backup and restore your registry data in case of data loss, corruption, or disaster. Also, use application tools like Skopeo or Crane to replicate your registry data across different regions or zones for high availability and faster recovery in case of a successful attack.

Container Orchestrator Security

The fifth and final step to secure your containers is to secure the container orchestrator. You do that by following these best practices:

• Use a mature and reliable orchestrator. Use an orchestrator that has a proven track record of stability, performance, and security. Examples of such orchestrators include Kubernetes, Docker Swarm, and Mesos. Use the latest stable version of the orchestrator and keep it updated with the latest security patches and bug fixes.
• Harden your orchestrator’s security. Apply security best practices to your orchestrator configuration, such as enabling TLS encryption, RBAC authorization, network policies, Pod security policies, and admission controllers. You can use tools like CIS Benchmarks or OpenSCAP to audit and enforce your configuration settings.

If you use Kubernetes as your container orchestrator, you should check out the following articles:

• Kubernetes Security Best Practices
• Certified Kubernetes Administrator Exam Series (Part-6): Security

Take the first step to certify your container security skills by enrolling in our Certified Kubernetes Security Specialist (CKS).

Conclusion

Container security should be a top priority as attacks become more sophisticated. You need to secure every layer of your container stack, from the host OS to the orchestrator, using the best practices we discussed. By doing so, you can enjoy the benefits of containers without compromising the security of your applications and data.

If you have any questions or feedback, please leave a comment below.

If you're interested in learning more about DevOps, you can sign up for a free account on KodeKloud. As a member, you’ll have access to 70+ courses, labs, quizzes, and projects, that will help you master different DevOps skills.