Container Runtime Security Cheat Sheet

Updated 2026-03-17

Next Topic: Container Security Cheat Sheet

Container runtime security protects containerized workloads throughout their lifecycle by enforcing isolation, restricting privileges, and detecting threats. Containers share the host kernel, making the runtime layer—the interface between the kernel and container processes—a critical attack surface. Modern container security combines Linux kernel primitives (namespaces, cgroups, capabilities), mandatory access control systems (AppArmor, SELinux), and runtime monitoring tools to prevent escapes, privilege escalation, and lateral movement. As supply chain attacks and container breakouts intensify in 2026, teams must layer defense-in-depth controls from build to runtime, integrating image signing, vulnerability scanning, and behavior-based threat detection into every deployment.

What This Cheat Sheet Covers

This topic spans 14 focused tables and 72 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: User and Privilege IsolationTable 2: Linux CapabilitiesTable 3: System Call Filtering and MACTable 4: Filesystem and Storage SecurityTable 5: Namespace IsolationTable 6: Resource Limits and DoS PreventionTable 7: Container Image SecurityTable 8: Alternative Container RuntimesTable 9: Runtime Threat Detection and MonitoringTable 10: Kubernetes Pod Security StandardsTable 11: Network Security for ContainersTable 12: Supply Chain and Build SecurityTable 13: Container Escape PreventionTable 14: Audit and Compliance

Table 1: User and Privilege Isolation

Technique	Example	Description
Rootless Containers	`podman run --rm alpine whoami`	• Containers run as a non-root user on the host • Docker daemon runs without root privileges, eliminating root-level attack surface entirely.
User Namespaces	`docker run --userns-remap=default nginx`	• Maps container root (UID 0) to an unprivileged user on the host • even if a breakout occurs, the attacker has no host root access.
runAsNonRoot	`securityContext:` `runAsNonRoot: true` `runAsUser: 1000`	• Kubernetes security context that forces containers to run as a non-root user • the pod fails to start if the image uses UID 0.

Table 1: User and Privilege Isolation

Technique	Example	Description
Rootless Containers	`podman run --rm alpine whoami`	• Containers run as a non-root user on the host • Docker daemon runs without root privileges, eliminating root-level attack surface entirely.
User Namespaces	`docker run --userns-remap=default nginx`	• Maps container root (UID 0) to an unprivileged user on the host • even if a breakout occurs, the attacker has no host root access.
runAsNonRoot	`securityContext:` `runAsNonRoot: true` `runAsUser: 1000`	• Kubernetes security context that forces containers to run as a non-root user • the pod fails to start if the image uses UID 0.