Container security: Docker a Kubernetes

Proč je Container Security kritická?

Kontejnery změnily způsob, jakým vyvíjíme a deployujeme aplikace, ale také přinesly nové bezpečnostní rizika:

Sdílený kernel: Všechny kontejnery na hostu sdílejí stejný OS kernel - kernel exploit může kompromitovat celý host
Image vulnerabilities: podle Sysdig 2023 Cloud-Native Security and Usage Report má 87 % container images zranitelnosti se závažností high nebo critical
Misconfigurations: Privilegované kontejnery, mounted Docker socket, exposed APIs
Supply chain risks: Untrusted base images, malicious layers, backdoored dependencies
Runtime threats: Container breakout, lateral movement, crypto mining
Secrets exposure: Hardcoded credentials, env variables, mounted secrets
Network attacks: Pod-to-pod lateral movement bez network policies

Známé container security incidenty

Tesla Kubernetes cryptojacking (odhaleno 2018): Kubernetes konzole bez hesla vystavila AWS credentials, útočníci na infrastruktuře těžili Monero (zjištění RedLock)
Docker Hub malicious images (2018): 17 backdoorovaných images z účtu docker123321 obsahovalo cryptominery a reverse shelly, Docker je odstranil 10. května 2018 (BleepingComputer)
RunC vulnerability (CVE-2019-5736): Container breakout: přepsání runc binárky na hostu a root access (runc do 1.0-rc6, Docker před 18.09.2)
Kinsing malware: Zneužívá veřejně dostupné Docker API bez autentizace, spouští cryptominer a přes SSH se šíří na další hosty a kontejnery (Aqua Security)

Vrstvy Container Security

Defense in Depth přístup

1. Build Time Security

Zabezpečení během image build procesu

Base image selection (minimal, trusted sources)
Dockerfile best practices (non-root user, no secrets)
Image scanning pro CVEs (Trivy, Snyk, Clair)
Multi-stage builds pro menší attack surface
Image signing a verification (Cosign, Notation); Docker Content Trust (Notary v1) končí 8. prosince 2026

2. Registry Security

Zabezpečení container registry

Private registries s autentizací
Image vulnerability scanning v registry
Access control (RBAC, IAM)
Image retention policies
Webhook notifications na nové vulnerabilities

3. Orchestration Security (Kubernetes)

Zabezpečení Kubernetes cluster

Pod Security Standards (Restricted, Baseline)
Network Policies (CNI-based isolation)
RBAC pro users a service accounts
Admission Controllers (OPA, Kyverno)
Secrets management (Vault, External Secrets)

4. Runtime Security

Monitoring a protection běžících kontejnerů

Runtime behavior monitoring (Falco, Tetragon)
Anomaly detection
Process/file/network monitoring
Intrusion prevention
Audit logging

5. Host Security

Zabezpečení underlying infrastructure

Minimal host OS (COS, Bottlerocket)
Kernel hardening (AppArmor, SELinux)
Host patching a updates
CIS Benchmarks compliance
Node isolation

Docker Security Best Practices

Bezpečný Dockerfile

# ŠPATNĚ - Security issues
FROM ubuntu:latest
RUN apt-get update && apt-get install -y curl
COPY secret.key /app/
ENV DB_PASSWORD="hardcoded123"
USER root
EXPOSE 22

# DOBŘE - Secure Dockerfile
# 1. Use specific version tag (ne latest)
FROM node:24.22.0-alpine3.24

# 2. Install security updates
RUN apk update && apk upgrade && \
    apk add --no-cache dumb-init && \
    rm -rf /var/cache/apk/*

# 3. Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# 4. Set working directory
WORKDIR /app

# 5. Copy only necessary files
COPY --chown=nodejs:nodejs package*.json ./
RUN npm ci --omit=dev && npm cache clean --force

COPY --chown=nodejs:nodejs . .

# 6. Switch to non-root user
USER nodejs

# 7. Expose only necessary ports
EXPOSE 3000

# 8. Use exec form for CMD (signal handling)
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["node", "server.js"]

# 9. Health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD node healthcheck.js || exit 1

Docker Compose security

# compose.yaml

services:
  app:
    image: myapp:1.2.3

    # Read-only root filesystem
    read_only: true
    tmpfs:
      - /tmp
      - /var/run

    # Drop all capabilities, add only needed
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

    # Non-root user
    user: "1001:1001"

    # Security options
    security_opt:
      - no-new-privileges:true

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

    # Secrets from file (ne environment)
    secrets:
      - db_password

    environment:
      - NODE_ENV=production
      - DB_HOST=postgres
      # NO hardcoded secrets!

    networks:
      - app_network

secrets:
  db_password:
    file: ./secrets/db_password.txt

networks:
  app_network:
    driver: bridge

Image Scanning nástroje

Open Source

Trivy

Open-source scanner od Aqua Security pro container images, filesystems, git repos a Kubernetes.

Detekuje CVEs v OS packages a aplikačních závislostech
Podporuje Docker, containerd, Kubernetes
Rychlý (seconds) s offline mode
IaC scanning (Terraform, CloudFormation)
Secret detection
SBOM generation

Open Source

Clair

Static analysis tool pro vulnerabilities v container images, vyvíjený v rámci projektu Quay.

Layer-by-layer analysis
Multiple vulnerability databases
API-first design
Integration s Quay registry

Commercial

Snyk Container

Developer-first container security s fix recommendations.

Base image recommendations
Prioritized fix guidance
CI/CD integration
Kubernetes deployment scanning

Cloud Native

AWS ECR Scanning

Nativní image scanning v Amazon ECR registries.

Basic scanning (AWS native technologie, OS packages)
Enhanced scanning (Amazon Inspector, OS i jazykové balíčky)
Scan on push, u Enhanced i continuous scanning
EventBridge notifications

Praktický příklad: Trivy v CI/CD

# GitHub Actions - Trivy scan
name: Container Security Scan

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  trivy_scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # upload-sarif
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail build on HIGH/CRITICAL

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Trivy config scan (Dockerfile)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          scan-type: 'config'
          scan-ref: '.'
          format: 'table'

Akce v příkladu jsou připnuté na plný commit SHA. V březnu 2026 útočníci přepsali 76 ze 77 tagů aquasecurity/trivy-action na kód, který kradl CI/CD secrets (CVE-2026-33634, Aqua Security). Mutable tag ani @master proti tomu nechrání.

Kubernetes Security

Pod Security Standards

Kubernetes definuje tři úrovně Pod Security Standards, které vynucuje vestavěný Pod Security Admission. PodSecurityPolicy byla odstraněna ve verzi 1.25:

# Privileged - No restrictions (dev only)
# Baseline - Minimal restrictions (prevents known privilege escalations)
# Restricted - Heavily restricted (hardened, follows pod hardening best practices)

# Namespace labeling pro enforcement
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

---
# Restricted Pod příklad
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  namespace: production
spec:
  securityContext:
    # Run as non-root
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000

    # Seccomp profile (required by Restricted)
    seccompProfile:
      type: RuntimeDefault

  containers:
  - name: app
    image: myapp:1.0.0

    securityContext:
      # Read-only root filesystem
      readOnlyRootFilesystem: true

      # Drop all capabilities
      capabilities:
        drop:
          - ALL

      # No privilege escalation
      allowPrivilegeEscalation: false

      # Non-root
      runAsNonRoot: true
      runAsUser: 1000

    # Resource limits
    resources:
      limits:
        memory: "256Mi"
        cpu: "500m"
      requests:
        memory: "128Mi"
        cpu: "250m"

    # Writable volumes pouze kde nutné
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /app/cache

  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}

Network Policies

# Default Deny All (best practice baseline)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# Allow specific ingress/egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api

  policyTypes:
  - Ingress
  - Egress

  # Ingress rules
  ingress:
  - from:
    # Only from frontend pods in the same namespace
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

  # Egress rules
  egress:
  # Allow DNS
  # namespaceSelector + podSelector in ONE item = AND
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

  # Allow database
  - to:
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - protocol: TCP
      port: 5432

Položky v seznamu from/to se sčítají (OR), selektory v jedné položce platí současně (AND). Namespace vybírejte podle labelu kubernetes.io/metadata.name, který Kubernetes nastavuje automaticky (Kubernetes: Network Policies).

Runtime Security

Open Source (CNCF Graduated)

Falco

Runtime security tool používající eBPF pro monitoring syscalls a detekci anomálií. Od února 2024 graduated projekt CNCF.

Detekuje abnormal behavior (shell spawn, file access)
Custom rules (Falco rules syntax)
Kubernetes-aware
Real-time alerting
Integration s SIEM

Open Source

Tetragon

eBPF-based security observability a runtime enforcement od Cilium.

Process execution monitoring
File access tracking
Network connections
Syscall filtering
Policy enforcement

Falco rules příklad

# /etc/falco/falco_rules.local.yaml

# Detekce shell spawned v containeru
- rule: Shell Spawned in Container
  desc: Detect shell spawned in container
  condition: >
    spawned_process and
    container and
    proc.name in (bash, sh, zsh) and
    not proc.pname in (sh, bash, docker, containerd)
  output: >
    Shell spawned in container
    (user=%user.name container_id=%container.id
    image=%container.image.repository
    proc=%proc.cmdline parent=%proc.pname)
  priority: WARNING
  tags: [container, shell, mitre_execution]

# Detekce sensitive file reads
- rule: Read Sensitive File
  desc: Detect reads of sensitive files
  condition: >
    open_read and
    container and
    fd.name in (/etc/shadow, /etc/sudoers, /root/.ssh/id_rsa)
  output: >
    Sensitive file opened for reading
    (user=%user.name file=%fd.name
    container=%container.name image=%container.image)
  priority: CRITICAL
  tags: [filesystem, mitre_credential_access]

# Detekce crypto mining
- rule: Crypto Miner Detected
  desc: Detect known crypto mining processes
  condition: >
    spawned_process and
    proc.name in (xmrig, ethminer, cpuminer)
  output: >
    Crypto miner detected!
    (process=%proc.name cmdline=%proc.cmdline)
  priority: CRITICAL
  tags: [malware, cryptomining]

Container Security Best Practices - Shrnutí

Build Time

Používejte minimal base images (alpine, distroless, scratch)
Specific version tags (ne latest)
Multi-stage builds pro menší images
Scan images před push do registry (Trivy, Snyk)
Non-root user
No secrets v images nebo Dockerfile
Sign images (Cosign, Notation)

Kubernetes Deployment

Pod Security Standards (Restricted pro production)
Network Policies (default deny all)
Resource limits (CPU, memory)
RBAC (least privilege)
Secrets z external store (Vault, AWS Secrets Manager)
Admission controllers (OPA, Kyverno)
Service mesh pro mTLS (Istio, Linkerd)

Runtime

Runtime monitoring (Falco, Tetragon)
Anomaly detection a alerting
Audit logging
Incident response playbooks
Regular security audits

Co NEDĚLAT

Používat latest tag v production
Run containers as root
Mount Docker socket do containeru
Privilegované kontejnery bez důvodu
Hardcoded secrets v images
Žádné network policies
Disable security features pro "rychlejší debugging"
Ignorovat scan results

Zdroje

Sysdig: Sysdig 2023 Cloud-Native Security and Usage Report (press release) (únor 2023)
BleepingComputer: Tesla Internal Servers Infected With Cryptocurrency Miner (únor 2018)
BleepingComputer: 17 Backdoored Docker Images Removed From Docker Hub (červen 2018)
NVD: CVE-2019-5736 (červen 2026)
Aqua Security: Threat Alert: Kinsing Malware Attacks Targeting Container Environments (srpen 2023)
Aqua Security: Trivy Supply Chain Attack: What You Need to Know (duben 2026)
NVD: CVE-2026-33634 (březen 2026)
Docker Docs: Content trust in Docker (červen 2026)
Docker Docs: Version and name top-level elements (červenec 2025)
Kubernetes: Pod Security Standards (srpen 2026)
Kubernetes: Network Policies (duben 2026)

Container Security

Co je Container Security?

Proč je Container Security kritická?

Známé container security incidenty

Vrstvy Container Security

Defense in Depth přístup

1. Build Time Security

2. Registry Security

3. Orchestration Security (Kubernetes)

4. Runtime Security

5. Host Security

Docker Security Best Practices

Bezpečný Dockerfile

Docker Compose security

Image Scanning nástroje

Trivy

Clair

Snyk Container

AWS ECR Scanning

Praktický příklad: Trivy v CI/CD

Kubernetes Security

Pod Security Standards

Network Policies

Runtime Security

Falco

Tetragon

Falco rules příklad

Container Security Best Practices - Shrnutí

Build Time

Kubernetes Deployment

Runtime

Co NEDĚLAT

Zdroje

Chcete to mít vyřešené bez vlastního DevOps týmu?

Co je Container Security?

Proč je Container Security kritická?

Známé container security incidenty

Vrstvy Container Security

Defense in Depth přístup

1. Build Time Security

2. Registry Security

3. Orchestration Security (Kubernetes)

4. Runtime Security

5. Host Security

Docker Security Best Practices

Bezpečný Dockerfile

Docker Compose security

Image Scanning nástroje

Trivy

Clair

Snyk Container

AWS ECR Scanning

Praktický příklad: Trivy v CI/CD

Kubernetes Security

Pod Security Standards

Network Policies

Runtime Security

Falco

Tetragon

Falco rules příklad

Container Security Best Practices - Shrnutí

Build Time

Kubernetes Deployment

Runtime

Co NEDĚLAT

Zdroje

Další články z tématu

Bezpečnost CI/CD Pipeline

DAST - Dynamické testování bezpečnosti

Jak začít s DevSecOps - Průvodce pro začátečníky

Chcete to mít vyřešené bez vlastního DevOps týmu?

Používáme cookies