container security Archives - ITFROMZERO

Guide to Configuring Linux Capabilities (cap-drop and cap-add) in Docker to Harden Security

By IT From Zero October 5, 2026

A detailed guide on hardening Linux Capabilities with cap-drop=ALL and cap-add in Docker. Prevent container escapes, standardize Docker Compose, and debug permission denied errors in production.

Security

Runtime Security Monitoring with Tracee: The eBPF ‘Magic Eye’ for Linux Systems

By IT From Zero August 25, 2026

Hackers using fileless malware or container escapes? Don't worry, Tracee with the power of eBPF helps you capture every anomaly on Linux with high performance.

Security

Configuring Seccomp Profiles for Linux and Docker Containers: Reducing Attack Surface by Filtering System Calls

By IT From Zero June 16, 2026

A practical guide to configuring Seccomp profiles for Docker containers and Linux services to filter dangerous system calls, reduce attack surface, and prevent privilege escalation attacks. Covers custom JSON profiles, systemd configuration, and debugging syscalls with strace.

Virtualization

How to Install and Use gVisor to Secure Containers: Running Docker with an Isolated Kernel

By IT From Zero May 28, 2026

gVisor is a sandbox runtime for Docker that places a virtual kernel layer (Sentry) between the container and the host kernel to prevent container escape. This guide covers installing runsc, configuring Docker, and verifying the sandbox with practical command examples.

Security

SBOM: The “X-Ray” for Dependency Analysis and Vulnerability Scanning with Syft & Grype

By IT From Zero May 19, 2026

Learn how to use Syft and Grype for dependency analysis and automated vulnerability scanning. Secure your software supply chain with SBOM – a modern security standard for SREs and DevSecOps.

Security

Trivy: The ‘Sentry’ for Ultra-Fast Docker and K8s Vulnerability Scanning for DevOps

By IT From Zero May 1, 2026

Don't leave your container systems vulnerable to hackers. A detailed guide on using Trivy for Docker and Kubernetes scanning, with automated CI/CD integration in minutes.

Docker

Distroless Docker Images: Remove Unnecessary Shell and OS to Harden Container Security

By IT From Zero April 28, 2026

Google's Distroless Images strip the shell, package manager, and unnecessary OS components from Docker containers — significantly reducing the attack surface. This guide covers how to use multi-stage builds with Distroless for Go, Python, and Java, along with real-world vulnerability comparison and testing techniques.

Security

Runtime Security for Kubernetes with Falco: Real-time Anomaly Detection

By IT From Zero March 28, 2026

Runtime security is key to protecting Kubernetes from threats hidden deep within containers. Falco, a powerful anomaly detection tool, helps you monitor and alert in real-time. This article guides you through installation, custom rule configuration, and practical tips to make Falco a robust shield for your cluster.

Security

Kubernetes Security: Essential Steps to Protect Your Cluster

By IT From Zero March 23, 2026

A Kubernetes cluster has numerous security vulnerabilities out of the box if it isn't properly hardened. This article breaks down the most common causes and walks through setting up RBAC, Pod Security, Network Policy, secret management, and runtime monitoring to effectively protect your production cluster.

Docker

Docker Container Security: Best Practices for Developers

By IT From Zero March 5, 2026

A practical guide to Docker container security: from non-root users and read-only filesystems to network isolation, secret management, and vulnerability scanning. A complete checklist to review before deploying to production.