Container Security Issues
Misconfigured containers running as root, with excessive capabilities, privileged mode, or mounting sensitive host paths can allow container escape. This gives attackers access to the underlying host and other containers.
Overview
Container security encompasses multiple layers: base image vulnerabilities, runtime configuration, orchestration security (Kubernetes), and network policies. Misconfigurations such as running as root, using privileged mode, mounting the Docker socket, or exposing the Kubernetes API can lead to container escape and full infrastructure compromise.
Impact
Container escape to host OS, lateral movement between containers, access to host filesystem and network, cluster compromise.
Remediation
Run containers as non-root, drop all unnecessary capabilities, avoid privileged mode, use read-only filesystems, scan images for vulnerabilities, and implement network policies.
Run containers as non-root users
Drop all unnecessary Linux capabilities
Never use privileged mode in production
Use minimal base images and scan for CVEs
Implement Kubernetes Network Policies
Enable Pod Security Standards/Admission
Related SuperClue scanner checks
These scanner checks look for signs of Container Security Issues. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works