Cloud, Kubernetes and Infrastructure Security
Container Runtime Security
We review your containers' runtime permissions. We identify settings that allow movement from a container to the host.
What it is
Containers share the operating system kernel. Isolation depends on runtime settings. Privileged mode, broad Linux capabilities or access to the host file system weaken isolation. The assessment reviews these settings according to NIST SP 800-190 and the CIS Docker Benchmark.
Scope
- Privileged containers and processes running as root
- Linux capabilities, seccomp, and AppArmor or SELinux profiles
- Sharing of the host file system, network, and process namespace
- Access to container runtime sockets
- Coverage of runtime monitoring rules
The need
When organizations need it
- When third-party images or customer code run on your infrastructure.
- When build servers and CI/CD runners are shared via containers.
- When a vulnerability affecting container isolation is announced and you need to know which servers are affected.
Method
How we work
-
Inventory
We list running containers, their images, and runtime settings for each host.
-
Isolation review
We assess how each workload could reach the host and other containers.
-
Detection test
With your approval, we generate harmless test behavior and check whether your monitoring detects it.
-
Least-privilege profile
We propose the narrowest runtime settings required for each workload.
Outcome
What you have at the end
You know which containers pose a risk of escape to the host. Least-privilege runtime settings and monitoring gaps for each workload are documented.
Frequently asked questions
We already scan our images. Isn't that enough?
Image scanning finds known vulnerabilities in the image. It does not show which permissions the container starts with. The runtime assessment addresses this gap.
Will running containers without root break our applications?
Some images are not ready for this. That is why we recommend changes per workload, after testing them in a test environment.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting