BestHub
Sign in
Tagged articles

container security

89 articles · Page 1 of 1
Ubuntu
Ubuntu
Sep 27, 2026 · Information Security

Ubuntu Kernel Patches Go Weekly: AI-Driven Vulnerability Flood Forces 4x Speedup

Canonical has accelerated Ubuntu kernel patch releases from a four-week cycle to weekly due to AI-automated vulnerability discovery overwhelming patching capacity, exemplified by a container-escape vulnerability (CVE-2026-80521) with public proof-of-concept but no patch yet for three LTS releases, prompting mitigation guidance including live patching, capability dropping, and microVM isolation.

AI-driven threatsLinux kernelUbuntu
0 likes · 13 min read
Ubuntu Kernel Patches Go Weekly: AI-Driven Vulnerability Flood Forces 4x Speedup
Tech Musings
Tech Musings
Aug 31, 2026 · Cloud Native

Securing DeepSeek Harness in Multi-Tenant Containers: Removing Filesystem Plugins to Reduce Attack Surface

The author details removing filesystem tool plugins from DeepSeek Harness (DSH) to secure multi-tenant container deployments, covering plugin architecture, overlay-based disabling, impact on 6 tools, real-model attack testing showing bash as a residual channel mitigated by sandbox fail-closed behavior, and resource metrics showing negligible savings.

Attack SurfaceDeepSeek HarnessPlugin Architecture
0 likes · 15 min read
Securing DeepSeek Harness in Multi-Tenant Containers: Removing Filesystem Plugins to Reduce Attack Surface
Ops Community
Ops Community
Jun 7, 2026 · Information Security

Practical Container Escape Detection and Defense Strategies

This article outlines a comprehensive, step‑by‑step approach to detecting and preventing container escape attacks, covering threat modeling, vulnerability classification, hardening layers, key open‑source tools, CI/CD integration, incident response, compliance checks, and ATT&CK matrix mapping for robust Kubernetes security.

KubernetesTrivyattack detection
0 likes · 43 min read
Practical Container Escape Detection and Defense Strategies
MaGe Linux Operations
MaGe Linux Operations
Jun 1, 2026 · Information Security

Docker Production Hardening: From Image Scanning to Runtime Protection

This guide walks through a comprehensive Docker security hardening process for production, covering image vulnerability scanning, minimal base images, signed images, secure Dockerfile practices, daemon hardening, runtime privilege reduction, network isolation, secret management, monitoring, and a checklist to ensure continuous protection.

DockerSecret Managementcontainer security
0 likes · 25 min read
Docker Production Hardening: From Image Scanning to Runtime Protection
Tech Ocean
Tech Ocean
Apr 19, 2026 · Cloud Native

Docker Day 12: Core Security Practices – Avoid Running Images as Root

This guide outlines Docker's three security pillars—image, runtime, and network—by recommending official images, regular updates, vulnerability scanning, non‑root users, read‑only filesystems with tmpfs, capability dropping, secrets management, and tools like Docker Scout and Trivy, followed by a concise checklist.

DockerDocker ScoutNon-root User
0 likes · 4 min read
Docker Day 12: Core Security Practices – Avoid Running Images as Root
Tech Ocean
Tech Ocean
Apr 19, 2026 · Cloud Native

Docker Day 5: Multi‑Stage Builds and Build Caching for Smaller, Faster Images

This article shows how to shrink Docker images and speed up builds by using multi‑stage builds, ordering instructions for layer caching, fine‑tuning .dockerignore, merging RUN commands, picking lightweight base images, and running containers as a non‑root user, with concrete code examples and build‑time measurements.

Dockerbuild-cachecontainer security
0 likes · 6 min read
Docker Day 5: Multi‑Stage Builds and Build Caching for Smaller, Faster Images
Cloud Architecture
Cloud Architecture
Apr 10, 2026 · Information Security

Spring Boot Deployment Security Guide: From Monolith to Cloud‑Native Zero‑Trust Production

This comprehensive guide walks through why simple Spring Security is insufficient for production, outlines eight core security principles, presents a threat model, and provides step‑by‑step recommendations—including authentication, token design, configuration management, input validation, logging, rate limiting, container hardening, Kubernetes policies, service‑mesh mTLS, supply‑chain scanning, and audit—to transform a Spring Boot application into a zero‑trust, production‑grade service.

AuthenticationAuthorizationKubernetes
0 likes · 38 min read
Spring Boot Deployment Security Guide: From Monolith to Cloud‑Native Zero‑Trust Production
SpringMeng
SpringMeng
Dec 24, 2025 · Information Security

Technical Breakdown of Why Kuaishou Was Hacked

Within a 60‑90 minute window on Dec 22, hackers breached Kuaishou’s systems, exploiting nighttime staffing fatigue, high‑privilege token leaks, AI moderation tricks, direct video uploads, massive account overload, and microservice architecture flaws, highlighting critical security gaps for large platforms.

AI moderation evasionKuaishoucontainer security
0 likes · 4 min read
Technical Breakdown of Why Kuaishou Was Hacked
MaGe Linux Operations
MaGe Linux Operations
Oct 22, 2025 · Information Security

Build a Zero‑Trust Container Security Pipeline in 10 Practical Steps

This guide walks you through a ten‑step zero‑trust framework for hardening container security—from supply‑chain image signing and SBOM generation to runtime threat detection, network policies, secret encryption, and continuous monitoring—targeted at production Kubernetes clusters of any scale.

Image Signingcontainer securityruntime protection
0 likes · 31 min read
Build a Zero‑Trust Container Security Pipeline in 10 Practical Steps
MaGe Linux Operations
MaGe Linux Operations
Oct 18, 2025 · Information Security

Master Container Security: Complete Guide to Image Scanning and Zero‑Trust Runtime Protection

This comprehensive guide walks you through securing container workloads by defining applicable scenarios, setting up prerequisites, installing Trivy and Falco, hardening Dockerfiles, integrating CI/CD scanning and signing, configuring Kubernetes security contexts, network policies, pod security admission, runtime protection, Harbor registry hardening, regular scanning, monitoring, troubleshooting, and best‑practice recommendations.

Kubernetescontainer securityimage scanning
0 likes · 32 min read
Master Container Security: Complete Guide to Image Scanning and Zero‑Trust Runtime Protection
Ops Community
Ops Community
Sep 18, 2025 · Information Security

Essential Linux Security: Common Vulnerabilities and Practical Defense Strategies

This guide walks you through the most critical Linux security flaws—from privilege‑escalation and misconfigured sudo to SSH, web server, kernel, and container risks—offering concrete hardening steps, logging practices, firewall rules, incident‑response procedures, and compliance tips to build a resilient production environment.

Linux securityLog MonitoringSSH Hardening
0 likes · 16 min read
Essential Linux Security: Common Vulnerabilities and Practical Defense Strategies
Ops Community
Ops Community
Aug 23, 2025 · Information Security

Top 10 Linux Security Threats in 2025 Every Ops Engineer Must Know

This 2025 Linux security threat report breaks down the ten most critical risks—ranging from supply‑chain poisoning to AI‑driven APT attacks—offering real‑world case studies and actionable, step‑by‑step mitigation strategies for Linux operations teams.

Linux securitySupply Chaincontainer security
0 likes · 14 min read
Top 10 Linux Security Threats in 2025 Every Ops Engineer Must Know
MaGe Linux Operations
MaGe Linux Operations
Aug 13, 2025 · Information Security

Master Docker Security: End-to-End Hardening from Image Build to Runtime

Learn how to protect Docker containers throughout their lifecycle—starting with secure base image selection and vulnerability scanning, through Dockerfile hardening, runtime configurations, network isolation, storage encryption, and continuous monitoring—using practical examples, scripts, and tools like Trivy, Docker Content Trust, Falco, and custom Seccomp profiles.

CI/CDDockercontainer security
0 likes · 19 min read
Master Docker Security: End-to-End Hardening from Image Build to Runtime
MaGe Linux Operations
MaGe Linux Operations
Jul 28, 2025 · Information Security

Master Docker Container Security: Real Attack Scenarios & Defense Strategies

Explore comprehensive Docker container security from an attacker’s perspective to expert defenses, featuring real-world escape incidents, threat matrices, five detailed penetration testing scenarios, enterprise-grade protection frameworks, monitoring scripts, and actionable best practices for securing images, runtimes, networks, and access controls.

DevSecOpsDockerPenetration Testing
0 likes · 17 min read
Master Docker Container Security: Real Attack Scenarios & Defense Strategies
MaGe Linux Operations
MaGe Linux Operations
Jul 9, 2025 · Cloud Native

Master Kubernetes Production Security: Essential Practices & Configurations

This guide walks operations engineers through a comprehensive, layered security model for production Kubernetes clusters, covering cluster hardening, network policies, RBAC, pod security standards, image scanning and signing, runtime monitoring, key management, compliance checks, and recommended tooling.

KubernetesRBACRuntime monitoring
0 likes · 13 min read
Master Kubernetes Production Security: Essential Practices & Configurations
Cloud Native Technology Community
Cloud Native Technology Community
Jun 13, 2025 · Cloud Native

CNAPP: The Key to Securing Cloud‑Native Applications from Containers to Lifecycle

This article examines the evolution of container security into comprehensive cloud‑native protection, explaining CNAPP concepts, technical roadmaps, industry challenges, and best‑practice recommendations for integrating security across the entire application lifecycle, while highlighting market trends and future directions.

CNAPPDevSecOpscloud-native
0 likes · 26 min read
CNAPP: The Key to Securing Cloud‑Native Applications from Containers to Lifecycle
Raymond Ops
Raymond Ops
Apr 15, 2025 · Information Security

How to Exploit Docker for Linux Privilege Escalation – A Step‑by‑Step Guide

This article walks through Docker privilege escalation techniques on Linux, covering Docker basics, permission discovery, manual and automated enumeration with LinPEAS, and three practical breakout scenarios—including abusing Docker group rights, escaping privileged containers, and breaking out of non‑privileged containers using SUID binaries and release_agent attacks.

DockerLinPEASLinux
0 likes · 25 min read
How to Exploit Docker for Linux Privilege Escalation – A Step‑by‑Step Guide
Full-Stack DevOps & Kubernetes
Full-Stack DevOps & Kubernetes
Mar 14, 2025 · Cloud Native

How to Shrink Docker Images with Multi‑Stage Builds: A Step‑by‑Step Guide

Learn why smaller Docker images boost build speed and deployment efficiency, then master Docker’s multi‑stage build technique—including basic concepts, a Go example, layer reduction, cache optimization, minimal base images, non‑root users, and build arguments—to produce lightweight, secure, and maintainable containers.

DevOpsDockerGo
0 likes · 9 min read
How to Shrink Docker Images with Multi‑Stage Builds: A Step‑by‑Step Guide
MaGe Linux Operations
MaGe Linux Operations
Jan 24, 2025 · Information Security

How to Secure Docker Images with Trivy: Step-by-Step Guide

This guide explains how to set up Docker on Ubuntu 18.04, install and configure the Trivy vulnerability scanner, and use it to analyze container images such as Redis, BusyBox, and Nginx, covering database updates, output formats, and practical command examples.

CVEDockerLinux
0 likes · 9 min read
How to Secure Docker Images with Trivy: Step-by-Step Guide
Alibaba Cloud Infrastructure
Alibaba Cloud Infrastructure
Dec 17, 2024 · Cloud Native

Recap of Kubernetes Community Day 2024 Jakarta: Generative AI, eRDMA, Container Security, and Observability

The Kubernetes Community Day held in Jakarta on November 30, 2024 featured Alibaba Cloud experts presenting best‑practice sessions on scaling generative AI workloads, eRDMA network acceleration, container image security, and OpenTelemetry‑based observability within the ACK Kubernetes platform.

Kubernetescloud-nativecontainer security
0 likes · 6 min read
Recap of Kubernetes Community Day 2024 Jakarta: Generative AI, eRDMA, Container Security, and Observability
Alibaba Cloud Native
Alibaba Cloud Native
Sep 11, 2024 · Information Security

Securing Serverless Containers with Cloud Security Center: Architecture & Challenges

The article explains how Cloud Security Center protects Serverless container workloads through vulnerability scanning, intrusion detection, baseline checks, and isolation, outlines the integration architecture and workflow, examines key challenges such as multi‑tenant isolation, resource consumption and blast‑radius control, and presents test results and future security roadmap.

Serverlesscloud securitycontainer security
0 likes · 10 min read
Securing Serverless Containers with Cloud Security Center: Architecture & Challenges
Linux Ops Smart Journey
Linux Ops Smart Journey
Sep 1, 2024 · Information Security

Secure Container Images: Integrate Cosign with Harbor

This guide explains how to enhance container image security by installing Cosign, generating key pairs, signing images, and configuring Harbor to trust the signatures, including step‑by‑step commands and parameter details for seamless integration of Cosign into Harbor's registry.

HarborImage Signingcontainer security
0 likes · 7 min read
Secure Container Images: Integrate Cosign with Harbor
Linux Ops Smart Journey
Linux Ops Smart Journey
Aug 27, 2024 · Information Security

Secure Your Container Images: Integrate Trivy Scanning into Harbor

This guide explains how to secure container images by integrating the Trivy vulnerability scanner into the Harbor registry, covering Helm configuration, offline database setup, automated updates via cron, verification steps, and useful references for a robust cloud‑native security workflow.

KubernetesTrivycontainer security
0 likes · 7 min read
Secure Your Container Images: Integrate Trivy Scanning into Harbor
MaGe Linux Operations
MaGe Linux Operations
Jun 30, 2024 · Information Security

How to Break Out of Docker Containers and Gain Root Access on Linux

This tutorial walks through Docker privilege‑escalation techniques, showing how to enumerate Docker permissions, exploit docker group membership, use GTFOBins and LinPEAS, and break out of both privileged and non‑privileged containers to obtain a root shell on the host.

DockerLinuxRoot Access
0 likes · 25 min read
How to Break Out of Docker Containers and Gain Root Access on Linux
DevOps Operations Practice
DevOps Operations Practice
Jun 6, 2024 · Cloud Native

Step‑by‑Step Guide to Deploying an Enterprise‑Grade Harbor Private Registry

This article explains why enterprises need a private Docker registry, introduces the open‑source Harbor project, outlines its architecture and hardware/software requirements, and provides detailed installation, configuration, and usage instructions—including Docker, Docker‑Compose, and Harbor setup commands—to get a secure, CNCF‑certified container image repository up and running.

CNCFDevOpsDocker
0 likes · 7 min read
Step‑by‑Step Guide to Deploying an Enterprise‑Grade Harbor Private Registry
Liangxu Linux
Liangxu Linux
Dec 4, 2023 · Cloud Native

Running Business Containers as Non-Root: Practical Guide and Real-World Scripts

This article explains why running business containers without root privileges is essential for security, outlines the necessary background and risks, and provides detailed step‑by‑step methods, Dockerfile snippets, entrypoint scripts, and real‑world examples for MySQL, Redis, CoreDNS, Consul, and cAdvisor to achieve safe non‑root container deployments.

CoreDNSENTRYPOINTKubernetes
0 likes · 16 min read
Running Business Containers as Non-Root: Practical Guide and Real-World Scripts
Open Source Linux
Open Source Linux
Nov 8, 2023 · Information Security

Top 10 Docker Vulnerability Scanners to Secure Your Containers in 2023

This article reviews the most popular Docker security tools, explains their key features, and shows how they help organizations automatically scan images, detect vulnerabilities, enforce policies, and improve container runtime protection across development and production environments.

DevOpsDockercloud-native
0 likes · 12 min read
Top 10 Docker Vulnerability Scanners to Secure Your Containers in 2023
MaGe Linux Operations
MaGe Linux Operations
Oct 31, 2023 · Cloud Native

Mastering Docker: Practical Tools, Root Concepts, and Container Security

This article explores Docker's practical usage, the problems it addresses for developers and operations, its future development, Docker Hub services, technical limitations, and detailed security considerations for both the Docker environment and container deployments, including Hyper-V host setup.

DevOpsHyper‑Vcloud-native
0 likes · 12 min read
Mastering Docker: Practical Tools, Root Concepts, and Container Security
Huolala Tech
Huolala Tech
Oct 23, 2023 · Information Security

How Huolala Secures Kubernetes: Real-World Container Security Practices

This article details Huolala's end‑to‑end container security strategy—from Kubernetes component basics and a real unauthorized‑access incident to lifecycle‑based safeguards, threat‑matrix guidance, image/ecosystem/baseline/runtime protections, and a custom HIDS architecture—offering practical insights for cloud‑native environments.

DevSecOpsHIDSKubernetes
0 likes · 14 min read
How Huolala Secures Kubernetes: Real-World Container Security Practices
37 Interactive Technology Team
37 Interactive Technology Team
Sep 25, 2023 · Cloud Native

Investigation of Kubernetes Container Isolation Mechanism and Its Impact

The article investigates a cloud‑vendor Kubernetes isolation feature that inserts iptables DROP rules into a pod’s network namespace, demonstrating how it fully blocks traffic, triggers liveness‑probe restarts, and impacts services depending on replica count and probe configuration, while preserving state only without probes.

KubernetesLivenessProbecontainer security
0 likes · 7 min read
Investigation of Kubernetes Container Isolation Mechanism and Its Impact
MaGe Linux Operations
MaGe Linux Operations
Sep 12, 2023 · Information Security

Mastering Container Vulnerability Management: Secure DevOps Strategies

This article explains how containers work, outlines the challenges of detecting and fixing vulnerabilities throughout the software lifecycle, and presents practical strategies—including CI/CD pipeline, registry, runtime, and host scanning—plus key principles for building a robust container security program.

CI/CDDevOpscontainer security
0 likes · 7 min read
Mastering Container Vulnerability Management: Secure DevOps Strategies
Huolala Safety Emergency Response Center
Huolala Safety Emergency Response Center
Sep 7, 2023 · Information Security

How Huolala Secured Its Kubernetes Workloads: A Deep Dive into Container Security Practices

This article details Huolala's comprehensive container‑security program, covering Kubernetes component basics, a real‑world unauthorized‑access incident, a lifecycle‑based security framework, the Microsoft threat matrix, and the design of a home‑grown HIDS architecture to protect cloud‑native workloads.

DevSecOpsHIDSKubernetes
0 likes · 12 min read
How Huolala Secured Its Kubernetes Workloads: A Deep Dive into Container Security Practices
Didi Tech
Didi Tech
Jul 4, 2023 · Cloud Native

eBPF Technology and Its Application in Didi's Cloud-Native Observability: HuaTuo Platform Practice

eBPF, a safe, high‑performance Linux kernel extension evolving from the 1993 Berkeley Packet Filter to modern dynamic tracing, underpins Didi’s HuaTuo platform, which consolidates bytecode management, fast data processing, stability self‑healing, and container insight to solve traffic replay, topology, security, and root‑cause analysis challenges across cloud‑native services, with plans to broaden business use and community collaboration.

Huatuocloud-nativecontainer security
0 likes · 12 min read
eBPF Technology and Its Application in Didi's Cloud-Native Observability: HuaTuo Platform Practice
Bilibili Tech
Bilibili Tech
Apr 18, 2023 · Cloud Native

Kubernetes Audit Log Analysis for Container Security

The article explains how to enable Kubernetes audit logging and use its detailed fields—such as userAgent, responseStatus, requestURI, and object references—to detect CDK‑generated attacks and other threats like CVE‑2022‑3172, privilege escalation, and backdoor deployment, offering practical detection examples and security recommendations.

API ServerAudit LoggingCDK
0 likes · 15 min read
Kubernetes Audit Log Analysis for Container Security
MaGe Linux Operations
MaGe Linux Operations
Apr 15, 2023 · Cloud Native

What’s New in Kubernetes v1.27? Key Features, Upgrades, and Deprecations

Kubernetes v1.27, the first 2023 release, introduces 60 enhancements—including 9 graduating to stable—updates image repositories, upgrades SeccompDefault, Job mutable scheduling, DownwardAPIHugePages, and many beta features, while deprecating several older APIs and command‑line flags, with detailed upgrade guidance and availability links.

Deprecationscontainer securityfeature upgrades
0 likes · 12 min read
What’s New in Kubernetes v1.27? Key Features, Upgrades, and Deprecations
Cloud Native Technology Community
Cloud Native Technology Community
Apr 6, 2023 · Industry Insights

What Sysdig’s 2023 Cloud‑Native Security Report Reveals About Container Risks

Sysdig’s 2023 Cloud‑Native Security and Usage Report uncovers that most container images carry critical vulnerabilities, a majority of granted permissions go unused, many containers lack proper CPU limits, and significant cloud‑cost waste persists, prompting urgent recommendations for identity‑access management, vulnerability prioritisation, and zero‑trust adoption.

Resource OptimizationSysdig reportcloud-native
0 likes · 8 min read
What Sysdig’s 2023 Cloud‑Native Security Report Reveals About Container Risks
Programmer DD
Programmer DD
Dec 21, 2022 · Information Security

Hidden Threats in Docker Hub: 1,652 Malicious Images Uncovered by Sysdig

Sysdig’s analysis of over 250,000 public Linux images on Docker Hub revealed 1,652 images containing hidden malware, including mining tools, embedded credentials, proxy‑avoidance scripts, and malicious websites, highlighting the urgent need for robust image‑scanning and credential‑management practices.

Credential ManagementDockerMalware
0 likes · 4 min read
Hidden Threats in Docker Hub: 1,652 Malicious Images Uncovered by Sysdig
DeWu Technology
DeWu Technology
Dec 9, 2022 · Information Security

Container Security: Risks and Mitigation Strategies

Container security demands vigilant mitigation of risks such as image poisoning, unsafe images, compliance violations, high‑risk vulnerabilities, and container escape by preferring official images, scanning for malware and secrets, enforcing CIS benchmarks, applying cgroup and namespace isolation, and deploying runtime detection agents on each Kubernetes node for rapid response.

Dockercontainer securityimage scanning
0 likes · 13 min read
Container Security: Risks and Mitigation Strategies
ByteDance SYS Tech
ByteDance SYS Tech
Nov 23, 2022 · Operations

How Virtio-fs Achieves Crash Recovery for High‑Availability Secure Containers

This article explains the design of Virtio-fs, its architecture and high‑availability features, and details the crash‑recovery mechanism—including crash models, state preservation, supervisor coordination, request idempotence, downtime optimization, and hot upgrade/migration—implemented by ByteDance's STE team for secure container workloads.

Crash RecoveryFUSEKVM
0 likes · 16 min read
How Virtio-fs Achieves Crash Recovery for High‑Availability Secure Containers
MaGe Linux Operations
MaGe Linux Operations
Jul 17, 2022 · Operations

How to Build Tiny, Fast Docker Images: 4 Proven Optimization Tricks

This article explains Docker image fundamentals and presents four practical techniques—removing package caches, ordering layers by change frequency, separating build and runtime stages, and inspecting layers with dive—to dramatically shrink image size, speed up builds, and improve security.

Cache CleaningDockerImage Optimization
0 likes · 10 min read
How to Build Tiny, Fast Docker Images: 4 Proven Optimization Tricks
Liangxu Linux
Liangxu Linux
Jul 10, 2022 · Information Security

Why Docker’s 127.0.0.1 Port Mapping Still Exposes Services – Proof and Fix

A recent Hacker News discussion revealed that Docker’s iptables rule allows containers bound to 127.0.0.1 to be reachable from other hosts, and a step‑by‑step proof‑of‑concept demonstrates the issue while a revised iptables rule is proposed to enforce proper source‑address restrictions.

DockerPort Mappingcontainer security
0 likes · 7 min read
Why Docker’s 127.0.0.1 Port Mapping Still Exposes Services – Proof and Fix
DevOps Cloud Academy
DevOps Cloud Academy
Jun 30, 2022 · Information Security

Integrating Trivy Image Security Scanning into GitLab CI/CD Pipelines

This tutorial demonstrates how to set up automated Docker image vulnerability scanning with Trivy, embed the scan into GitLab CI/CD pipelines, handle severity thresholds, schedule recurring scans, and remediate findings by adjusting the Dockerfile, providing a practical DevOps security workflow.

CI/CDCVE scanningDevOps
0 likes · 10 min read
Integrating Trivy Image Security Scanning into GitLab CI/CD Pipelines
Bilibili Tech
Bilibili Tech
Jun 17, 2022 · Information Security

Container Escape Techniques, Exploits, and Mitigation Strategies

The article explains how attackers can break out of Docker containers by exploiting misconfigurations, vulnerable Docker components, kernel bugs, or Kubernetes RBAC errors, illustrates real‑world exploits such as host‑proc mounts and CVE‑2019‑5736, and provides mitigation steps like limiting privileges, updating software, and securing configurations.

Dockercgroupcontainer security
0 likes · 15 min read
Container Escape Techniques, Exploits, and Mitigation Strategies
MaGe Linux Operations
MaGe Linux Operations
Apr 5, 2022 · Information Security

Essential Docker Security Practices: Hardening Images and Containers

This article explains Docker's role in modern development, distinguishes images from containers, and provides concrete security measures—including least‑privilege users, minimal base images, multi‑stage builds, and AppArmor profiles—to harden Docker deployments against attacks.

AppArmorDockercontainer security
0 likes · 11 min read
Essential Docker Security Practices: Hardening Images and Containers
Cloud Native Technology Community
Cloud Native Technology Community
Apr 2, 2022 · Information Security

How to Shift Security Left in Cloud‑Native Environments: Expert Q&A Recap

In this recap of the sixth CNBPA Technical Practice Salon, senior product manager Wen Lei and architect Ren Yazhou answer audience questions on ensuring container security, Kubernetes design considerations, risk assessment methods, and the choice between open‑source and commercial cloud‑native security solutions, emphasizing a security‑left approach throughout the DevOps lifecycle.

DevOpsKubernetescloud-native
0 likes · 4 min read
How to Shift Security Left in Cloud‑Native Environments: Expert Q&A Recap
DevOps Cloud Academy
DevOps Cloud Academy
Mar 14, 2022 · Information Security

Integrating Trivy Vulnerability Scanner with GitLab CI/CD Pipelines

This article explains what Trivy is, how to install and use it for container vulnerability scanning, demonstrates saving results in JSON, and provides a step‑by‑step guide to integrating Trivy into a GitLab CI/CD pipeline with example configuration and troubleshooting tips.

DockerGitLab CITrivy
0 likes · 7 min read
Integrating Trivy Vulnerability Scanner with GitLab CI/CD Pipelines
Cloud Native Technology Community
Cloud Native Technology Community
Feb 21, 2022 · Industry Insights

What the Sysdig 2022 Cloud‑Native Security Report Reveals About Container Risks

The Sysdig 2022 Cloud‑Native Security and Usage Report shows that a majority of production containers and images contain high‑severity vulnerabilities, many cloud accounts expose S3 buckets, and mis‑configured resource limits lead to significant cost overruns, highlighting urgent security and operational challenges for enterprises adopting cloud‑native technologies.

KubernetesSysdig reportcloud usage
0 likes · 8 min read
What the Sysdig 2022 Cloud‑Native Security Report Reveals About Container Risks
Cloud Native Technology Community
Cloud Native Technology Community
Jan 19, 2022 · Information Security

Securing Cloud‑Native Platforms in Banking: A Multi‑Layer Container Security Guide

This article examines how banks can adopt cloud‑native container technologies while addressing security challenges through a four‑layer architecture covering infrastructure, platform, container, and full‑lifecycle risk mitigation, offering practical recommendations for robust, compliant cloud operations.

bankingcloud-nativecontainer security
0 likes · 8 min read
Securing Cloud‑Native Platforms in Banking: A Multi‑Layer Container Security Guide
Liangxu Linux
Liangxu Linux
Jul 13, 2021 · Information Security

Why Running Docker Containers as Root Is Dangerous and How to Avoid It

Running Docker containers as root or with the --privileged flag can expose the host to unnecessary risks; this article explains the differences, demonstrates root usage in common images, and provides practical methods—such as specifying non‑root users in Dockerfiles or using security contexts—to securely run containers.

$rootKubernetesPodSecurityPolicy
0 likes · 7 min read
Why Running Docker Containers as Root Is Dangerous and How to Avoid It
MaGe Linux Operations
MaGe Linux Operations
Jul 8, 2021 · Information Security

How to Secure Every Layer of Your Container Stack: Best Practices

This article outlines comprehensive container security best practices across kernel, container image, runtime, pod, network, node, and cluster components, emphasizing how to harden each layer in Kubernetes environments to protect against attacks and maintain robust, scalable deployments.

Best PracticesDevSecOpsKubernetes
0 likes · 9 min read
How to Secure Every Layer of Your Container Stack: Best Practices
DevOps
DevOps
May 7, 2021 · Information Security

Container Image Security: Challenges, Scanning in the SDLC, and Best Practices

This article examines the growing security concerns of container images, presents alarming vulnerability statistics, explains why image scanning should be placed before image push in the CI/CD pipeline, and outlines practical best‑practice recommendations such as using lightweight base images, non‑root users, secret management, minimal packages, Dockerfile linting, and avoiding unmaintained images.

DevSecOpsDockercontainer security
0 likes · 14 min read
Container Image Security: Challenges, Scanning in the SDLC, and Best Practices
Programmer DD
Programmer DD
Apr 22, 2021 · Information Security

How Hackers Hijack GitHub Actions to Run Free Crypto Mining

Hackers exploit GitHub Actions by submitting malicious pull requests that add hidden workflows, downloading and executing crypto‑mining binaries on GitHub’s free servers, a technique that has spread to other CI platforms and poses a persistent security challenge.

CI/CD SecurityGitHub ActionsMalware
0 likes · 9 min read
How Hackers Hijack GitHub Actions to Run Free Crypto Mining
Open Source Linux
Open Source Linux
Jan 29, 2021 · Cloud Native

Essential Kubernetes Best Practices for Production Clusters

This guide presents a comprehensive checklist of production‑grade Kubernetes best practices, covering container image selection, registry management, namespace isolation, labeling, security controls, CI/CD, monitoring, service mesh adoption, and advanced features to keep clusters stable, secure, and efficient.

DevOpsKubernetescontainer security
0 likes · 17 min read
Essential Kubernetes Best Practices for Production Clusters
MaGe Linux Operations
MaGe Linux Operations
Jan 7, 2021 · Information Security

How to Secure Your Docker Images: 3 Essential Practices

This guide explains why Docker containers improve security, then details three fundamental steps—running images as non‑root users, using a private registry, and keeping images minimal—plus practical commands, multi‑stage builds, and Docker Content Trust to protect your containerized applications from attacks.

DevOpsDockerImage Hardening
0 likes · 10 min read
How to Secure Your Docker Images: 3 Essential Practices
Open Source Linux
Open Source Linux
Aug 20, 2020 · Operations

How to Shrink Docker Images: Multi‑Stage Builds, Distroless, Alpine & Guix

This article explains why Docker images often become oversized and presents several practical techniques—manual Dockerfile edits, multi‑stage builds, Google’s distroless images, Alpine Linux bases, and GNU Guix packaging—to dramatically reduce image size while balancing debugging convenience and security.

Alpine LinuxDistrolessDocker
0 likes · 8 min read
How to Shrink Docker Images: Multi‑Stage Builds, Distroless, Alpine & Guix
Liangxu Linux
Liangxu Linux
Aug 16, 2020 · Information Security

How Doki Malware Exploits Misconfigured Docker APIs to Mine Cryptocurrency

The Ngrok‑based Doki malware silently scans for Docker API endpoints with weak configurations, hijacks containers to run crypto miners, uses the Dogecoin blockchain for dynamic C2 domains, and evades detection, highlighting the critical need to secure Docker APIs.

Cryptocurrency MiningDockerMalware
0 likes · 6 min read
How Doki Malware Exploits Misconfigured Docker APIs to Mine Cryptocurrency
Alibaba Cloud Native
Alibaba Cloud Native
Mar 30, 2020 · Cloud Native

Why Secure Containers Matter: From OCI to Kata and gVisor

This article explains the concept of secure containers, their definition based on the OCI specification, and how projects like Kata Containers and gVisor implement isolation layers to provide VM‑level security with container‑level performance in cloud‑native environments.

Kata Containerscloud-nativecontainer security
0 likes · 19 min read
Why Secure Containers Matter: From OCI to Kata and gVisor
Meituan Technology Team
Meituan Technology Team
Mar 12, 2020 · Information Security

Cloud Native Security: Container Escape and Mitigation Strategies

Meituan's security team explains cloud‑native architecture, outlines container‑escape threats from kernel bugs, vulnerable runtimes and misconfigurations, and recommends mitigation through hardened kernels, secure‑container runtimes like gVisor or Kata, rigorous patch management, and collaborative feature development to strengthen runtime protection.

DockerKata ContainersKubernetes
0 likes · 20 min read
Cloud Native Security: Container Escape and Mitigation Strategies
AntTech
AntTech
Dec 26, 2019 · Information Security

Understanding Secure Containers: From HyperContainer to Kata and gVisor

This article explains the concept of secure containers, traces their naming history, defines their role in cloud‑native environments, and details the architectures of Kata Containers and gVisor as modern solutions that add isolation layers to improve container security and performance.

Kata Containerscloud-nativecontainer security
0 likes · 12 min read
Understanding Secure Containers: From HyperContainer to Kata and gVisor
Ctrip Technology
Ctrip Technology
Nov 21, 2019 · Cloud Native

Cloud Native Drives Digital Transformation: From Containers to Serverless, Service Mesh, and Edge Computing

This article explains how cloud‑native technologies—including containers, Kubernetes, serverless platforms, service‑mesh architectures, standardized application management, and edge computing—are reshaping digital transformation by delivering extreme elasticity, security isolation, and seamless cloud‑to‑edge integration.

Serverlesscontainer securityedge computing
0 likes · 21 min read
Cloud Native Drives Digital Transformation: From Containers to Serverless, Service Mesh, and Edge Computing
AntTech
AntTech
Sep 28, 2019 · Information Security

Security Containers and Cloud Sandbox: Evolution, Architecture, and Future Directions

This article reviews the development of secure container technologies, including the history of container isolation, the design of MicroVM‑based solutions like Kata Containers, Alibaba Cloud's security sandbox architecture, performance benchmarks, and future challenges for secure cloud‑native runtimes.

Alibaba CloudCloud SandboxKata Containers
0 likes · 14 min read
Security Containers and Cloud Sandbox: Evolution, Architecture, and Future Directions
Alibaba Cloud Native
Alibaba Cloud Native
Sep 27, 2019 · Information Security

Why Secure Containers Matter: Inside Alibaba Cloud’s MicroVM Sandbox and Kata Containers

At the Cloud Conference, experts Wang Xu and Liu Jiang discuss the evolution of container security, compare traditional containers, MicroVMs, and process virtualization, detail Alibaba Cloud’s secure sandbox and Kata Containers implementation, share performance metrics, and outline future challenges for secure, high‑performance container runtimes.

Cloud SandboxMicroVMcloud-native
0 likes · 15 min read
Why Secure Containers Matter: Inside Alibaba Cloud’s MicroVM Sandbox and Kata Containers
dbaplus Community
dbaplus Community
Jul 25, 2019 · Operations

How to Secure Docker Containers with Namespaces and Cgroups

This guide explains Docker's Namespace and Cgroup mechanisms, shows how to configure them to limit resources and isolate containers, and demonstrates practical commands for protecting container security while highlighting their limitations.

DockerLinuxResource Limitation
0 likes · 16 min read
How to Secure Docker Containers with Namespaces and Cgroups
Efficient Ops
Efficient Ops
Jun 11, 2019 · Information Security

How OPPO Secures Docker at Scale: Deep Dive into Container Security Practices

This article summarizes OPPO's comprehensive Docker security strategy, covering the container ecosystem, key vulnerabilities, image and runtime protection, Kubernetes hardening, deep image scanning, host hardening, logging, traffic analysis, and future challenges in large‑scale container deployments.

KubernetesOPPOcontainer security
0 likes · 21 min read
How OPPO Secures Docker at Scale: Deep Dive into Container Security Practices
Tencent Cloud Developer
Tencent Cloud Developer
Feb 14, 2019 · Information Security

Critical runc Container Escape Vulnerability Advisory (CVE-2019-5736)

A critical CVE‑2019‑5736 vulnerability in the runc container runtime lets a malicious container overwrite the host’s runc binary, granting attackers root‑level code execution that can compromise other containers, the host system, and the network, with a CVSS 3.0 score of 7.2, affecting runc, Apache Mesos and LXC, and requiring prompt updates.

Vulnerabilitycontainer escapecontainer security
0 likes · 3 min read
Critical runc Container Escape Vulnerability Advisory (CVE-2019-5736)
JD Tech
JD Tech
Dec 10, 2018 · Information Security

Container Sandbox for Contextual Behavior Analysis Presented at BlackHat Europe

JD Security’s Silicon Valley AI security scientist unveiled a novel container‑based sandbox at BlackHat Europe, detailing how contextual behavior analysis can detect and trace malicious code by leveraging lightweight containers, improving threat detection speed and accuracy for enterprise defenses.

AI securitybehavior analysiscontainer security
0 likes · 6 min read
Container Sandbox for Contextual Behavior Analysis Presented at BlackHat Europe
dbaplus Community
dbaplus Community
Nov 5, 2018 · Information Security

Detecting Container Threats with Sysdig Falco: A Hands‑On Guide

This guide explains how to deploy Sysdig Falco on Docker, configure its rules, and demonstrate detection of four common container security threats—including interactive shells, unauthorized processes, writes to non‑user directories, and sensitive mounts—using real‑world examples and log analysis.

DevOpsDockerRuntime Threat Detection
0 likes · 9 min read
Detecting Container Threats with Sysdig Falco: A Hands‑On Guide
DevOps
DevOps
Nov 1, 2018 · Information Security

Docker Security Features: Capabilities, Image Signing, AppArmor, Seccomp, User Namespaces and More

This article explains Docker's built‑in security mechanisms—including Linux kernel capabilities, image signing, AppArmor MAC, Seccomp syscall filtering, user namespaces, SELinux, PID limits and additional kernel hardening tools—provides configuration examples, command‑line demonstrations, and guidance on using them safely.

AppArmorImage SigningLinux security
0 likes · 16 min read
Docker Security Features: Capabilities, Image Signing, AppArmor, Seccomp, User Namespaces and More
GF Securities FinTech
GF Securities FinTech
Sep 14, 2016 · Information Security

Securing Docker Microservices: Key Strategies from DockerCon 2016

At DockerCon 2016, Aaron Grattafiori outlined a comprehensive security framework for container‑based microservices, emphasizing user namespaces, custom AppArmor/SELinux policies, sec‑comp whitelists, hardened host OS, limited host access, network security, immutable containers, and secret management to achieve high‑assurance deployments.

AppArmorDockercontainer security
0 likes · 11 min read
Securing Docker Microservices: Key Strategies from DockerCon 2016
dbaplus Community
dbaplus Community
Feb 1, 2016 · Information Security

Boosting Application Security with Docker: Best Practices and Linux Capabilities

This article explains how Docker containers improve security through isolation, Linux namespaces, cgroups, capabilities, and image management, while also covering integration with virtual machines, bare‑metal deployment, lifecycle management, and open‑source security practices for modern microservice architectures.

DevOpsLinux capabilitiescontainer security
0 likes · 19 min read
Boosting Application Security with Docker: Best Practices and Linux Capabilities
Efficient Ops
Efficient Ops
Dec 21, 2015 · Operations

How to Eliminate Plaintext MySQL Passwords in Docker Containers

This article examines the security risk of exposing MySQL root passwords as plaintext environment variables in Docker containers and presents a practical volume‑replacement method, comparing it with password‑modification approaches while discussing Docker‑layer versus application‑layer considerations.

DevOpsDockerMySQL
0 likes · 10 min read
How to Eliminate Plaintext MySQL Passwords in Docker Containers