Containers and Kubernetes

Containers Are Processes

A container is a set of ordinary Linux processes isolated by namespaces, cgroups, capabilities and security profiles. Each of those layers can be switched off. --privileged removes almost all of them. Host namespaces share the host's processes or network. Added capabilities such as SYS_ADMIN reopen kernel interfaces.

NIST SP 800-190 recommends running containers with least privilege, read-only where possible and as non-root users. Images should be minimal and scanned for known vulnerabilities.

The Docker Control Plane

Whoever can talk to the Docker API can start a container that mounts the host's root filesystem. That makes the docker group, the docker.sock socket and any TCP listener as powerful as root. Exposing the API over TCP without mutual TLS is a common cause of cryptomining infections. Daemon defaults such as no-new-privileges, user namespace remapping and disabled inter-container communication reduce the damage a compromised container can do.

Kubernetes on the Node

Each node runs a kubelet whose API can execute commands in its pods. It must require authentication and use Webhook authorisation, never anonymous access or AlwaysAllow. Its unauthenticated read-only port should be off. etcd stores every cluster object, including Secrets, so its data directory and the cluster's kubeconfig and CA key files must be readable only by root.

In Summary

Containers share the host kernel. Privileged containers, host mounts and extra capabilities break isolation. Kubernetes needs the same least privilege thinking at every layer.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-CTR-,HOST-K8S-,HOST-DKR- --out p9
2. For the vulnerable container, list every isolation layer that was switched off and the docker run flag that switched it off.
3. On a test host with Docker: docker inspect --format '{{.HostConfig.Privileged}} {{.HostConfig.Binds}}' $(docker ps -q)

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-190, Application Container Security Guide
• OWASP Docker Security Cheat Sheet
• Kubernetes, Kubelet authentication and authorization

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P9: Containers and Kubernetes (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p9.html

@misc{openvapt_p9,
  author       = {{OpenVAPT}},
  title        = {{P9: Containers and Kubernetes}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p9.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}