6.4 Container and cluster security
You can name the ways a container escapes or a cluster gets owned, and block the common ones.
Before:05. Identity, Security & ComplianceUnlocks:07. Infrastructure as Code & CI/CD
Containers escape and clusters get owned along known routes, and this topic blocks the common ones: base images of known provenance, scanned for what they carry; processes running as non-root with capabilities dropped; RBAC and service accounts inside the cluster; and network policies replacing the default-allow posture that ships out of the box. It closes the containers module because each defence assumes the earlier topics. The confusion it corrects is treating the container boundary as a security boundary by itself — it is one layer, and the ones around it are not optional.
Work through these
Base image provenance and scanning
Every image inherits everything in its base image, including vulnerabilities nobody in your team introduced. Knowing where a base image came from and scanning it is the first control.
Running as non-root; dropping capabilities
A container running as the highest-privilege user has far more reach if it is compromised, and most applications never need it. Dropping privileges is a small change with a large effect.
RBAC inside the cluster and service accounts
Inside the cluster, permissions decide what a workload can ask the cluster to do, and the default identity attached to a workload is often more powerful than it needs to be. This is the internal counterpart of least privilege.
Network policies and default-allow as a mistake
By default pods can usually talk to every other pod, which means one compromised workload can reach everything. Network policies are how that default is closed.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 29 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.