Container hardening is the work of reducing the attack surface of both container images and running workloads. For a DevOps team, that means more than choosing a small image or setting a process to run as non-root: build and scan images, restrict runtime privileges, apply kernel and Kubernetes controls, test compatibility, and keep the controls current as applications change.
What container hardening protects
A container packages an application and its dependencies, but it still relies on the host kernel and the surrounding platform. Risks can enter through vulnerable image contents, excessive process privileges, unnecessary system calls, weak deployment settings, or overly broad access to the Kubernetes API and network.
As an Amazon Associate I earn from qualifying purchases.
Hardening layers controls across the image build, workload configuration, and cluster policy. No single measure makes a container invulnerable: a scan can miss issues, and restrictive settings can still leave permitted behavior available to an attacker.
How to harden a container image
Choose and maintain the starting image
Use trusted, maintained base images and include only the software the workload needs. Smaller images have fewer unnecessary components to maintain and assess. Docker’s base-image guidance describes minimizing image contents and using security-first defaults as part of image hardening.
#1 Best Overall
Track image sources and rebuild when relevant base layers or dependencies need updates. Scan images before deployment and establish an owner and process for resolving findings; scanning is a checkpoint, not a substitute for updates.
Keep remote administration tools out
Do not install SSH servers or other tools intended to provide remote shells to hosts in an application container. NIST SP 800-190, Application Container Security Guide (2017), states: “SSH and other remote administration tools designed to provide remote shells to hosts should never be enabled within containers.” Use the platform’s deployment and operational access mechanisms instead.
Which Kubernetes security settings should you use?
Start with least privilege, then validate each setting against the application’s actual file, port, and startup requirements. Kubernetes’ Application Security Checklist recommends non-root execution, disabling privilege escalation, a read-only root filesystem where feasible, and dropping capabilities. A representative container-level configuration looks like this:
Rank #2
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALLApply the settings at the appropriate pod or container level for the workload, and verify them against the Kubernetes version and deployment configuration in use. The example is a starting baseline, not a guarantee that every application can run unchanged.
Run with a non-root identity
Set a non-root user and group in the image or workload configuration where the application permits it. Kubernetes’ runAsNonRoot: true can help ensure the container does not start as root. Check ownership and permissions for application files, mounted volumes, and any directories the process must write to; changing the runtime identity without adjusting those permissions can cause access failures.
Disable escalation and make the root filesystem read-only
Set allowPrivilegeEscalation: false unless a justified workload requirement prevents it. Use readOnlyRootFilesystem: true when compatible. Identify the application’s legitimate write paths—such as temporary or state directories—and configure only those paths to be writable rather than making the entire root filesystem writable.
Rank #3
- Portable lock box that looks like a book; great for hiding small valuables on a bookshelf
- Fabric cover and spine designed to look like a book; does not contain paper pages; recommended to store in-between two books on a bookshelf
- Front cover lifts to reveal safe’s actual cover; key lock designed to deter theft; 2 keys included
- Interior space for hiding cash, credit cards, important documents, jewelry, and more
- Ideal for traveling or at home; backed by an Amazon Basics limited 1-year warranty
Drop capabilities and avoid privileged mode
Drop Linux capabilities by default, then add back only capabilities the application demonstrably needs. Avoid privileged: true for ordinary application workloads: Kubernetes documents that privileged mode grants all Linux capabilities and can override or undo restrictions from seccomp, AppArmor, and SELinux. If a workload requires host-level operations, document the precise need and constrain the exception as narrowly as the platform allows.
How seccomp and other Linux controls fit in
Use seccomp carefully
Seccomp filters the system calls a process can make. Kubernetes documents support as stable since v1.19. For many workloads, the runtime’s default seccomp profile is a suitable baseline. Kubernetes supports configuring seccomp at the pod or container level.
A custom profile can restrict calls further, but it adds a compatibility and maintenance burden. Application updates may introduce system calls the profile blocks, and every call left allowed remains available to the process. If you create custom profiles, observe the workload, test changes before rollout, version the profile, and assign responsibility for keeping it aligned with application updates. Kubernetes’ seccomp tutorial demonstrates learning the calls a process uses before applying a profile; its prerequisites and details are version-specific.
Rank #4
- Secure Storage Box: In addition to the realistic book appearance on the outside, these real paper transfer book safe have a thickened key lock box embedded inside to provide additional storage and secret hidden book safe box are strong enough; Hollow diversion book safe, don't hesitate to choose the style you need
- Hollow Book Safe: The book safe code lock money box is ideal for storing valuable personal items such as coins, bank cards, ID cards, secret hidden metal book box is great for home security or to carry valuables, travel in cash, keep your cash, passport, jewelry and other personal items safe and safe secret hidden metal lock box not easily found
- Book Appearance Combination Box: The safe looks like a book, just put book safe box for home on a desk or a bookshelf, or put diversion book money hiding box on a coffee table or bedside table, and book safe box for office can be fully integrated with books and other objects
- Versatile and Portable: This money hiding book box and faux book box hidden suits a variety of settings, including home, office, school, and travel; Diversion book storage box, portable design ensures easy access to your hidden items wherever you go
- Widely Use: These faux book hidden storage box, diversion book safe box for money can not only be used for bookcase decoration, coffee table book decoration, modern living room decoration, family warm home decoration, bookshelf decoration, TV rack decoration supplies; Diversion book safe box also has the function of secretly storing your small objects
Consider mandatory access controls and user namespaces
AppArmor and SELinux can add mandatory access controls where the operating system, runtime, and cluster support them. Check the actual kernel, distribution, container runtime, and Kubernetes version rather than assuming a policy will be enforced everywhere. Kubernetes’ cited documentation characterizes user-namespace support as early-stage, so verify current support and operational fit before relying on it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the baseline repeatable with policy
Use Kubernetes Pod Security Standards and admission or deployment policy to prevent secure settings from depending on individual operator memory. The Restricted profile targets current hardening practices, but can create compatibility costs for workloads that need permissions outside its constraints. Test workloads before enforcing it broadly, and manage exceptions with a named owner, documented rationale, and review point.
Review API access as well as process permissions. Kubernetes recommends setting automountServiceAccountToken: false unless a pod needs Kubernetes API access. Pair workload controls with suitable network isolation and identity and access management; the container boundary is only one layer of defense.
Choose controls by risk, compatibility, and upkeep
| Control | Where it applies | Primary risk addressed | Operational consideration |
|---|---|---|---|
| Minimized, maintained image plus scanning | Image build and deployment | Unnecessary image contents and known image vulnerabilities | Maintain base layers and dependencies; assign remediation ownership. |
| Non-root identity, disabled escalation, read-only root filesystem, and dropped capabilities | Workload runtime | Excessive process privileges and unnecessary write access | Test file ownership, writable paths, ports, and startup behavior. |
| Runtime-default seccomp profile | Workload runtime | Unrestricted system-call access beyond the runtime baseline | Confirm the profile is supported and suitable for the workload. |
| Custom seccomp profile | Workload runtime | Additional system calls beyond those specifically permitted | Observe, test, version, and update profiles as applications change. |
| Pod Security Standards and admission policy | Deployment and cluster admission | Workloads that violate the selected security baseline | Test compatibility, enforce consistently, and review exceptions. |
| AppArmor or SELinux policy | Host and workload, where supported | Access beyond the policy’s permitted operations | Verify support across the actual kernel, distribution, runtime, and cluster. |
When considering pre-hardened images or configuration guidance, assess supported platforms, update practices, compatibility, and cost. CIS describes its hardened images and configuration guidance as ways to reduce DIY hardening complexity; that does not establish that an image is vulnerability-free or best for every workload. There is no basis here for a vendor-by-vendor performance ranking.
Roll out hardening without breaking workloads
- Inventory the workload. Identify its image sources, required files and write paths, ports, capabilities, system calls, API access, and any host or device dependencies.
- Improve the image. Remove unnecessary contents and remote shell tools, use maintained inputs, scan before deployment, and define how findings and base-image updates will be handled.
- Apply least privilege in a test environment. Use a non-root identity where feasible, disable escalation, make the root filesystem read-only where compatible, and drop capabilities before adding back a documented requirement.
- Validate kernel controls. Begin with an appropriate runtime seccomp default. Add custom seccomp, AppArmor, or SELinux policy only when the platform supports it and the team can test and maintain it.
- Enforce with deployment policy. Select a suitable Pod Security Standard, test it against representative workloads, then roll it out with a managed exception process.
- Monitor and revisit. Re-scan and update images, review configuration and exceptions as software changes, and investigate operational signals that indicate a control is blocking legitimate behavior.
Keep hardening as an ongoing practice
Hardening is not a one-time image cleanup. Image contents, application behavior, platform versions, and deployment requirements change. Maintain the image-update and vulnerability-remediation process, verify that deployed settings still match the intended policy, and review exceptions when their underlying need changes. NSA’s Kubernetes Hardening Guidance (version 1.2, dated 2022-08-29) also treats least privilege, image scanning, and immutable filesystems as parts of a broader baseline; check current platform documentation when applying older guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
