Pillar guide

Container Security

A practical path from secure Docker images and Kubernetes controls to software supply-chain integrity, runtime detection, and isolated AI agents.

Start with the foundations Supply-chain deep dive

Build

Minimal, hardened images

Supply chain

SBOM, VEX, SLSA, signing

Runtime

Kubernetes, Falco, eBPF

AI agents

Isolation and least privilege

1. Container security foundations

Understand the boundaries, threat model, and shared-responsibility layers before choosing tools.

Start here

Container Security Fundamentals

The two sides of container security: securing the image supply chain and protecting running workloads.

Docker

Introduction to Containers

Images, containers, isolation, containerd, runc, and the OCI runtime stack.

Kubernetes

Introduction to Kubernetes

Pods, deployments, services, namespaces, Helm, and the orchestration model you need to secure.

2. Secure Docker images and builds

Make secure defaults part of the Dockerfile and build process instead of relying on a final scan.

Hands-on

Dockerizing a Java 26 Project with Docker Init

Build a modern multi-stage Dockerfile and establish a secure container baseline.

Hardening

Docker Hardened Images Are Free

Reduce inherited attack surface with minimal, open-source hardened base images.

Practical tips

Seven Docker Tips Every Engineer Should Know

Everyday image, Compose, Scout, and workflow improvements from Docker Captains.

3. Protect the software supply chain

Control dependencies, record what was built, sign the result, and promote only the digest that passed policy.

Pillar guide

Software Supply Chain Security

Connect SIP, Shai-Hulud, IX Hexbreaker, SBOM, VEX, SLSA, Cosign, DHI, and package cooldowns.

Immediate plan

SIP: Five Immediate Supply Chain Controls

A five-control plan spanning local agents, dependencies, hardened builds, attestations, and release gates.

SBOM

Generating an SBOM with Docker Scout

Inventory the packages inside an image and use the result to answer vulnerability questions.

4. Secure Kubernetes and runtime

Treat admission controls and static scans as the start, then detect suspicious behavior while workloads run.

Runtime detection

Falco: Cloud-Native Runtime Security

Use system-call visibility and eBPF-powered rules to detect anomalous container activity.

Scanner

Trivy for Images, Filesystems, and CI

Scan images for vulnerabilities, misconfigurations, secrets, and license concerns.

Learning path

Docker and Kubernetes Security Book

Follow the full path from container fundamentals through cluster hardening, monitoring, and audit.

5. Isolate AI agents and emerging threats

Developer agents and CI runners are privileged supply-chain participants. Constrain their filesystem, network, and credentials.

AI + CI/CD