Containers make deployment fast and isolation subtle. A container is not a small virtual machine; it is a process with boundaries provided by the host kernel.
What a container shares
- the host kernel;
- sometimes the network namespace;
- sometimes mounted volumes;
- the container runtime's configuration.
Namespaces isolate process IDs, mounts and networking. Cgroups limit resources. A kernel vulnerability or a privileged container can cross the boundary.
Kubernetes defaults to check
- RBAC: who can create pods, read secrets or exec into containers?
- Network policies: are pods allowed to talk to everything by default?
- Service accounts: does each workload have its own, with minimal permissions?
- Privileged containers: are they really required?
- Image provenance: are images pinned, scanned and signed?
- Secrets: are they mounted as files with restrictive permissions?
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.