How to Shift Security Left in Cloud‑Native Environments: Expert Q&A Recap

Event Overview

The sixth CNBPA Technical Practice Salon was held online, featuring senior product manager Wen Lei from Lingque Cloud and architect Ren Yazhou from XiaoYou Technology. They presented the theme “Security Left: an Essential Path for Enterprise Cloud‑Native Construction” and engaged with over a hundred IT professionals.

Q&A Highlights

Q: How to ensure the security of the container itself?

A: First, secure the container configuration to meet compliance by scanning Docker settings with security tools. Second, monitor runtime abnormal behaviors and respond promptly, thereby guaranteeing container security.

Q: What considerations and best practices should be taken into account for Kubernetes security in platform design?

A: The best practice is the “security left” model integrated with DevOps: introduce security considerations early in development and design phases, such as security modeling and defining security red lines, then apply image security measures for registries, runtimes, and the K8s cluster itself.

Q: Are there reference guidelines for container security risk assessment, given many unknown risks?

A: Use vulnerability scanning based on CVE databases, which provide security scores, and apply baseline standards like CIS benchmarks. Open‑source tools such as kube-bench can scan the environment and offer risk‑assessment recommendations.

Q: Should organizations use open‑source cloud‑native components or commercial products for cloud‑native security?

A: Many open‑source components exist (e.g., kube-bench for image scanning, kube-hunter for cluster vulnerability scanning). Teams with strong Kubernetes expertise may opt for these, while others might consider commercial solutions.

Conclusion

The session emphasized embedding security throughout the DevOps lifecycle—shifting security left—to address container and Kubernetes risks effectively, and highlighted practical tools and guidelines for both open‑source and commercial approaches.