Container Security, 2nd Edition

Chapter 15. Container Runtime Protection

In Chapter 10 you saw some approaches to strengthening container isolation using security profiles like seccomp, AppArmor, and SELinux. These all act at runtime, so they contribute to container runtime protection and limit the set of actions that containers can perform. In this chapter you will learn about more sophisticated security tools that provide more dynamic capabilities for detecting suspicious runtime activity, and use policies that can be tuned for individual workloads.

The term security observability refers to generating logs and metrics, along with tooling that helps teams understand security-relevant events that are happening in a deployment. Modern runtime security tools generate security observability data that includes container or Kubernetes identity information, making it much easier to correlate suspicious events to a specific containerized workload. Some tools can go further and selectively allow for policy enforcement that prevents suspicious activities from taking place.

This chapter starts by considering how we can take advantage of containerization to build workload-specific policies, and it lays out some of the types of behavior that tools could observe and restrict. Then we’ll look at technology options for enforcing runtime behavior, and we’ll consider some of the tools available.

One of the characteristics of containers is that they lend themselves to microservice architectures. Application developers can break ...