CORE DOMAIN -TOP LEVELSEC.CONTAINER

Container & DevSecOps Security

Linux kernel namespaces, cgroups v2 resource quotas, seccomp-bpf syscall filtering, container breakout prevention, and immutable image hardening.

Constituent Capability Skills (5)

Remediating Docker socket mount vulnerabilities, host filesystem exposures, and transitioning workloads to rootless runtimes.

SEC.CONTAINER.CGROUPS

2 Obj

Enforcing strict CPU, memory, and process count (pids.max) resource limits to prevent container denial-of-service and fork bombs.

View Details

Building minimal non-root distroless container images, signing images with Cosign, and scanning layers for vulnerable packages.

Configuring pid, net, mnt, ipc, and user namespaces to maintain isolation between container processes and host operating systems.

Developing granular seccomp-bpf JSON filter policies to deny dangerous kernel syscalls from container execution contexts.