October 2025
Intermediate to advanced
270 pages
7h 6m
English
Content preview from Container Security, 2nd Edition
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Appendix. Security Checklist
This appendix covers some important items you should at least think about when considering how best to secure your container deployments. In your environment, it might well not make sense to apply every item, but if you have thought about them, you will be off to a good start. No doubt this list is not absolutely comprehensive!
Are you running all containers as a non-root user? See “Containers Run as Root by Default”.
Are you running any containers with the
--privilegedflag? Are you dropping capabilities that aren’t needed for each image? See “The --privileged Flag and Capabilities”.Are you running containers as read-only where possible? See “Immutable Containers”.
Are you checking for sensitive directories mounted from the host? Are they read-only where possible? How about the Docker socket? See “Mounting Sensitive Directories” and “Mounting the Docker Socket”.
Are you running your CI/CD pipeline in your production cluster? Does it have privileged access or use the Docker socket? See “The Dangers of Docker Build”.
Are you generating signed images, with SBOMs and build attestations? Are you verifying signatures before you deploy containers? See Chapter 7 on supply chain security.
Are you scanning your container images for vulnerabilities? Do you have a process or tooling in place for rebuilding and redeploying containers where the image is found to include vulnerabilities? See Chapter 8 on software vulnerabilities in images.
Are you using a seccomp, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.