GUIDE · 6 min read
Container Image Hardening That Survives Production
Most container CVEs never get exploited — but the ones that do almost always succeed because the image runs as root with a writable filesystem. Fix the basics and you remove the blast radius.
Shrink the image
Distroless or chainguard base images. Fewer binaries = fewer LOLBins for the attacker.
Drop privileges by default
runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities, allowPrivilegeEscalation: false. Make these PodSecurity defaults.
- seccomp: RuntimeDefault
- AppArmor / SELinux enforcing
- No hostPath, no hostNetwork
Scan in the pipeline AND at runtime
Trivy/Grype at build time, Falco at runtime. Vulnerable images that never get pulled are a paperwork problem; vulnerable images running in prod are an incident.
Tools mentioned
TrivyGrypeFalcoChainguardDistrolessKyverno
⟩ takeaway
Small, non-root, read-only. Three properties that turn most container exploits into noisy failures.
⟩ keep reading
Related articles
Mobile Malware in 2026: How It Gets In and How to Stay Safer
Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.
Phishing Defense That Actually Works
AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.
Splunk Detection Tips: From Noisy Alerts to Real-Time Signal
SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.