Yellow - Containers

Container security resources for Docker, Kubernetes, image scanning, runtime security, platform hardening, and authorized container testing.

This page covers container and Kubernetes operations, hardening, vulnerability scanning, DFIR, and authorized testing. Keep centralized logging strategy in Security Logging and generic vulnerability management tooling in Blue Defense unless the tool is container-specific.

Related Sections

Container logging should feed the broader logging strategy.

Yellow - Logging and Security Architecture

Container image and dependency scanners also belong with vulnerability management.

Asset and Vulnerability Management

Container labs and vulnerable playgrounds belong in Training.

Practice Lab

Container Management

CLI and Runtime Tools

• gVisor - Container runtime sandbox.

• ctop - Top-like interface for container metrics.

Platforms and Web Tools

• Moby - Collaborative open source project for the Docker container ecosystem.

• Traefik - Reverse proxy and load balancer with Docker and Let's Encrypt integration.

• Kong - Cloud-native API gateway.

• Rancher - Kubernetes and container management platform.

• Portainer - Docker and Kubernetes management UI.

Logging and Monitoring

Container logging usually combines three layers:

• Container platform logs: daemon events, API calls, and container create/modify/delete activity.

• Host logs: operating system, kubelet, runtime, and platform logs. For example, Amazon EKS can ship control plane and workload logs to CloudWatch.

• Application logs: service logs written to stdout/stderr, a bind mount, or an external collector.

Common collection patterns:

• Persistent volume or bind mount for applications that write to files.

• Application-native logging to an external destination.

• Sidecar or DaemonSet collectors for Kubernetes workloads.

• Runtime log drivers that capture stdout and stderr.

Container Defense

Vulnerability and Configuration Scanning

• Clair - Static vulnerability analysis for container images.

• WhaleScan - Windows container vulnerability and benchmark scanner. Verify maintenance before relying on it for current coverage.

• Trivy - Scanner for container images, filesystems, repositories, and IaC misconfigurations.

• SecretScanner - Finds secrets in container images and filesystems.

• sandbox-attacksurface-analysis-tools - Tools for analyzing Windows sandbox attack surface.

• Docker Bench for Security - Checks Docker hosts against common security best practices.

• Anchore Engine - Legacy Anchore image analysis service. Modern Anchore workflows generally use Grype and Syft.

• GitGuardian Docker security cheat sheet

• OWASP Docker Security Cheat Sheet

DFIR and Investigation

• sysdig-inspect - Interface for container troubleshooting and security investigation.

  • sysdig

Container Pentesting

Use these references only for environments where you have explicit authorization.

Enumeration and Escapes

• Pentest Book - Docker and Kubernetes

• Understanding Docker container escapes

• Escaping containers for fun

• PTFM: Container Breakout - pg. 145

Offensive Tools

• kubesploit - Kubernetes-focused post-exploitation C2 framework.

• deepce - Docker enumeration, privilege escalation, and container escape checks.

• PENTESTING-BIBLE Docker for Pentesters

• PayloadsAllTheThings - Docker Pentest

• Docker for Pentesters

• Operator Handbook: Docker Exploit - pg. 64

Docker

Docker packages an application with its runtime, dependencies, system tools, and settings.

Basics and Reference

• Docker 101 tutorial

• Docker getting started image

• Docker Handbook

• DevOps with Docker

• Docker containers security

• Docker Jumpstart - Older but still useful introductory material.

• Operator Handbook: Docker Commands - pg. 61

Misc

• Whaler - Reconstructs Dockerfiles from Docker images.

2MB

Docker-Security-Cheatsheet_hp8lh3.pdf

PDF

Open

Kubernetes

Management and Observability

• Kubernetes

• kubectl cheat sheet

• red-kube - Red-team kubectl cheat sheet.

• Operator Handbook: KubeCTL - pg. 111

• kubebox - Terminal and web console for Kubernetes.

  • kubebox overview

• Kubernetes the Hard Way

• Kubernetes the Easy Way

• Hubble - Kubernetes network, service, and security observability using eBPF.

Offensive Tools

• peirates - Kubernetes penetration tool for authorized privilege escalation and pivot testing.

• Kubestroyer - Kubernetes misconfiguration exploitation toolkit.

Security Auditing

• kubesec - Kubernetes resource security risk analysis.

• netassert - Tests Kubernetes NetworkPolicy and related network controls.

• KubiScan - Scans Kubernetes clusters for risky permissions.

• rbac-police - Evaluates RBAC permissions with Rego policies.

  • Kubernetes privilege escalation from excessive permissions

Resources

• Kubernetes basics

• Kubernetes cheat sheet

• Kubernetes production best practices

• Operator Handbook: Kubernetes - pg. 107

• NSA/CISA Kubernetes hardening guidance

  • NCC Group review of the guidance

• OWASP Kubernetes Security Cheat Sheet

• kubernetes-security-best-practice

• k8s-security

• Kubernetes pentesting

• Kubernetes pentesting checklist

• Operator Handbook: Kubernetes Exploit - pg. 108

• kubernetes-simulator - Kubernetes security training platform.

• Kubernetes Goat - Interactive Kubernetes security learning playground.