Comprehensive 8-part series covering container security from image to runtime, from build to incident response — including AI-era threats.
Contents • Quick Start • Stack • Stats • Contributing
| # | Part | Topics | Read Time |
|---|---|---|---|
| 1 | Introduction & Overview | Attack surface, lifecycle framework, threat landscape, hands-on labs | 15 min |
| 2 | Image Security & Supply Chain | Image scanning, SBOM, Sigstore/Cosign, SLSA, Dockerfile hardening | 25 min |
| 3 | Runtime Security & Monitoring | eBPF, Falco, Tetragon, Seccomp, AppArmor, AI agent detection | 30 min |
| 4 | Kubernetes Security Hardening | RBAC, PSS, Network Policies, Secrets, Admission Control, Terraform | 30 min |
| 5 | Network Security & Zero Trust | mTLS, Service Mesh (Istio/Cilium), SPIFFE, micro-segmentation | 25 min |
| 6 | Security Tools & Platforms | Trivy, Falco, Wiz, Sysdig, Aqua, Snyk — comparison & cost analysis | 20 min |
| 7 | Best Practices & Checklist | 75-item checklist, maturity model, roadmap, automation scripts | 20 min |
| 8 | K8s Security in the AI Era | AI agent attacks, LLM threats, sandboxing, causal chain detection | 25 min |
| 9 | Platform Engineering Reference Architecture | Terraform + ArgoCD + CI/CD + security stack (end-to-end) | 30 min |
| 10 | Multi-tenancy & Developer Experience | Tenant isolation, Day-2 ops, security SLOs, golden images | 25 min |
New to container security? Read in order (Part 1 → 8).
Need something specific?
| Question | Go To |
|---|---|
| "What tools should I use?" | Part 6 — Tools & Platforms |
| "Give me a checklist" | Part 7 — 75-item Checklist |
| "How to harden Kubernetes?" | Part 4 — K8s Hardening |
| "How to detect runtime attacks?" | Part 3 — Runtime Security |
| "How to secure CI/CD pipeline?" | Part 2 — Supply Chain |
| "What about AI/LLM workloads?" | Part 8 — AI Era |
| "I'm a platform engineer — where to start?" | Part 9 — Reference Architecture |
| "Multi-tenancy and Day-2 ops?" | Part 10 — Multi-tenancy & DX |
| "Give me deployable code" | examples/ — Terraform, Kyverno, Falco, scripts |
| "How to become a Platform Engineer?" | Career Guide |
Build: Trivy + Syft + Grype + Cosign + Hadolint
Deploy: Kyverno + Sigstore Policy Controller
Runtime: Falco + Tetragon + Seccomp
Network: Cilium (CNI + Service Mesh + Hubble)
Monitor: Prometheus + Grafana + OpenSearch
CNAPP: Wiz (agentless) | Sysdig (runtime) | Aqua (container-native)
DevSec: Snyk (developer-first) | Docker Scout
Comply: Prisma Cloud (broadest coverage)
| Metric | Value | Source |
|---|---|---|
| Organizations using containers in production | 56% | CNCF Survey 2025 |
| K8s users in production | 82% | CNCF Survey 2025 |
| Time to first attack on new K8s cluster | 18 min | Wiz Research |
| Container lifespan (70% of containers) | < 5 min | Sysdig |
| Malicious packages published (2025) | 454,000+ | Sonatype |
| K8s security incidents (organizations) | 93% | CNCF Survey |
| AI breaches involving agentic systems | 1 in 8 | HiddenLayer 2026 |
| Container lateral movement attacks (YoY) | +34% | Vectra AI |
container-security-series/
├── README.md
├── LICENSE
├── CONTRIBUTING.md
├── .gitignore
├── docs/
│ ├── part1-introduction-overview.md
│ ├── part2-image-security-supply-chain.md
│ ├── part3-runtime-security-monitoring.md
│ ├── part4-kubernetes-security-hardening.md
│ ├── part5-network-security-zero-trust.md
│ ├── part6-security-tools-platforms.md
│ ├── part7-best-practices-checklist.md
│ ├── part8-kubernetes-security-ai-era.md
│ ├── part9-platform-engineering-reference-architecture.md
│ └── part10-multitenancy-developer-experience.md
└── examples/
├── terraform/main.tf # Hardened EKS (VPC + KMS + ECR + GuardDuty)
├── kyverno/policies.yaml # 10 production admission policies
├── falco/values.yaml # Production Helm values
├── falco/custom-rules.yaml # 10 custom detection rules
└── scripts/
├── bootstrap-security-stack.sh # Deploy full stack (run once)
├── security-audit.sh # Quick posture assessment
└── onboard-tenant.sh # Create secured namespace
- ✅ How container security works across the entire lifecycle
- ✅ Practical Dockerfile hardening (before/after examples)
- ✅ SBOM generation, image signing with Sigstore/Cosign
- ✅ Runtime threat detection with Falco & eBPF
- ✅ Kubernetes hardening (RBAC, PSS, NetworkPolicies, Secrets)
- ✅ Zero Trust networking with mTLS and service mesh
- ✅ Tool comparison with cost analysis (OSS vs Commercial)
- ✅ Ready-to-run automation scripts for cluster hardening
- ✅ Terraform modules for hardened EKS clusters
- ✅ NEW: AI agent threats and LLM workload security (2026)
Series nay cover phan Security cua Platform Engineering Roadmap (by mbianchidev).
| Roadmap Topic | Series Coverage | Part |
|---|---|---|
| Encryption, Certificates, TLS, PKI | mTLS, Sigstore, certificate management | 2, 5 |
| Authentication, Authorization, IAM | RBAC, Pod Identity, OIDC, Service Accounts | 4, 9 |
| OPA (Open Policy Agent) | OPA Gatekeeper + Kyverno so sanh chi tiet | 4, 6 |
| DevSecOps (SAST, DAST, Container Scanning) | Trivy, Grype, Hadolint, CI/CD pipeline | 2, 6, 9 |
| Threat Detection | Falco, Tetragon, GuardDuty, eBPF | 3, 8 |
| CNAPP, CDR | Wiz, Sysdig, Aqua, Prisma Cloud | 6 |
| Container (Docker, OCI, Registry) | Image hardening, scanning, signing, SBOM | 2 |
| Kubernetes (full topic list) | Hardening, PSS, NetworkPolicy, Secrets | 3, 4, 5 |
| Service Mesh (Istio, Linkerd) | mTLS, AuthorizationPolicy, Cilium mesh | 5 |
| CNI (Cilium) | Cilium vs Calico, L7 policies, Hubble | 5 |
| GitOps (ArgoCD, FluxCD) | ArgoCD security config, drift detection | 9 |
| IaC (Terraform) | Hardened EKS module, KMS, GuardDuty | 9 |
| Rollout (Canary, Blue-Green) | Argo Rollouts + Falco, auto-rollback | 9 |
| Observability (Prometheus, Grafana) | Security dashboards, SLOs, alerting | 9 |
| Platform Engineering (IDP, DevEx) | Self-service, golden images, onboarding | 10 |
| Multitenancy | Hard vs soft, namespace isolation, quotas | 10 |
| AI Workload Security | AI agent attacks, LLM threats, sandboxing | 8 |
Contributions are welcome! See CONTRIBUTING.md for guidelines.
- 🐛 Found an error? Open an issue
- 💡 Have a suggestion? Open a PR
- ⭐ Found this useful? Give it a star!
Van Hoang Kha
- GitHub: @vanhoangkha
This project is licensed under the MIT License.
Based on research from 40+ industry sources including:
Sysdig • Wiz • Docker • AquilaX • CNCF • Microsoft • Aqua Security • Falco Project • ARMO • Sigstore • AppSecSanta • TasrieIT • BeyondScale • HiddenLayer • Sonatype • GitGuardian • and more.
⭐ Star this repo if you find it useful!
"Shift left, but never skip right." — Container Security Series