CONTAINER AND KUBERNETES SECURITY

Container and Kubernetes Security is a practical engineering guide to defending every layer of the container stack. It starts from a single observation: the container stack is a stack of attack surfaces, and a cluster that is hardened at one layer will be compromised at the next. Real security is the discipline of defending all of them at once. The book walks through the full stack — the container attack surface and its six layers, image hygiene with distroless and minimal base images, software supply chain security with SLSA and Sigstore, SBOMs and provenance attestations, vulnerability scanning with prioritisation that actually works, admission control with OPA Gatekeeper and Kyverno, Pod Security Standards and security contexts, network policies and service mesh mTLS, runtime security with eBPF and Falco and Tetragon, secrets management with external operators, the real incidents that shaped the field from SolarWinds to Log4j to xz-utils, incident response for container workloads, and the trends reshaping the discipline. It covers the failure modes that quietly wreck container security: a base image with hundreds of unfixed CVEs running as root, an admission webhook that fails closed during a control-plane outage, a namespace with no network policy where any pod can reach the database, a signed-image policy bypassed by an unsigned init container, a supply chain compromise in a build dependency that ships a backdoor, an RBAC binding that grants wildcard permissions to a default service account. Each is presented with the failure, the countermeasure, and the operational tradeoff. Fourteen chapters, ~45,000 words. Real Dockerfiles, Kubernetes manifests, Kyverno policies, Falco rules, and Cosign commands. Written for security engineers, platform engineers, and SREs who need containers to be defensible in production.