Scan container images against current vulnerability databases and prioritise remediation using exploitability and reachability.
Information & Communications Technology
Container Security Scanning and Runtime Protection
Secure containerised workloads by scanning images for vulnerabilities, hardening runtime configurations and detecting anomalous container behaviour across Kubernetes clusters.
🗓️Duration5 training days
📚Content4 modules · 8 sessions
🎓On completionAccredited attendance certificate
About the programme
Course Overview
Container images bundle hundreds of transitive dependencies from base operating systems, language runtimes and application libraries, and any one of them can carry an exploitable vulnerability. Scanning at build time catches known flaws, but it says nothing about what a container actually does once it is running, which is where many real intrusions begin. This course teaches participants to build a layered defence: scanning images against current vulnerability databases, generating and verifying a software bill of materials, and enforcing admission control policies that block unsigned or high-severity images before they reach a cluster. Participants then move to runtime protection, configuring seccomp profiles, mandatory access control policies and Kubernetes network policies to shrink the attack surface of running workloads, and deploying behavioural detection rules that flag unexpected process execution, file access or outbound connections inside a container. Labs work through a deliberately vulnerable image, tracing a scan finding through remediation, rebuilding with a minimal base image, signing the image, and confirming the cluster admission controller rejects the unsigned predecessor. By the end, participants can design a scanning and signing pipeline, write runtime detection rules, and respond to a live container compromise using the evidence the platform captured.
Expected Learning Outcomes
Generate and verify a software bill of materials for container images to track dependency provenance.
Configure admission control policies that block unsigned, unscanned or high-severity images from deployment.
Harden running containers with seccomp profiles, mandatory access control policies and non-root user configurations.
Write Kubernetes network policies that restrict pod-to-pod and egress traffic to declared dependencies only.
Deploy runtime detection rules that flag unexpected process execution, file access or network connections.
Investigate a suspected container compromise using registry, admission and runtime security event logs.
Who Should Attend
Platform and DevOps engineers responsible for container build and deployment pipelines.
Security engineers extending vulnerability management practice into containerised environments.
Kubernetes administrators hardening cluster configuration against runtime attacks.
Application developers who need to remediate scan findings in their own container images.
Site reliability engineers who respond to container-related security incidents.
Compliance analysts verifying container supply chain controls for audits.
Course Modules
Select any module to see its sessions and points.
01Image Vulnerability Scanning and Remediation
2 sessions · 8 points
Session 1Scanning Pipelines and Vulnerability Triage
- Integrate image scanning tools into build pipelines so scans run automatically before every push to a registry.
- Interpret vulnerability severity scores alongside exploitability and reachability data to prioritise fixes.
- Distinguish base image vulnerabilities from application dependency vulnerabilities to route fixes to the right team.
- Set pipeline gates that fail a build when a critical vulnerability has no available patch or mitigation.
Session 2Reducing Attack Surface at Build Time
- Rebuild application images on minimal base images to remove unused shells and package managers.
- Apply multi-stage builds so build tools and secrets never reach the final runtime image.
- Pin base image and dependency versions to prevent unreviewed changes from entering a production build.
- Generate a software bill of materials for each image and store it alongside the build artefact.
02Supply Chain Integrity and Admission Control
2 sessions · 8 points
Session 1Image Signing and Provenance
- Sign container images cryptographically so downstream consumers can verify origin and integrity before deployment.
- Attach build provenance attestations that record which pipeline, commit and scanner produced an image.
- Configure a private registry to reject pushes of unsigned or unscanned images from untrusted sources.
- Rotate signing keys and manage a trust policy that survives pipeline and platform changes.
Session 2Admission Control Policy Design
- Write Kubernetes admission control policies that enforce signing and scan requirements before a pod is scheduled.
- Block deployment of containers running as root or requesting a privileged security context without justification.
- Enforce resource limits and read-only root filesystems as default admission requirements for new workloads.
- Stage new admission policies in audit mode before switching to enforcement to avoid blocking valid deployments.
03Runtime Hardening
2 sessions · 8 points
Session 1Kernel and Operating System Controls
- Configure seccomp profiles that restrict a container to the system calls its process actually requires.
- Apply mandatory access control policies that confine container file and network access beyond namespace isolation.
- Disable privilege escalation and drop unnecessary Linux capabilities from container security contexts.
- Enforce non-root user execution and immutable root filesystems for workloads that do not need write access.
Session 2Network Segmentation for Workloads
- Design Kubernetes network policies that default-deny traffic and allow only declared service dependencies.
- Segment namespaces by trust boundary so a compromised pod cannot reach unrelated workloads or secrets.
- Restrict egress traffic to approved destinations to limit data exfiltration paths from a compromised container.
- Test network policy changes against real traffic patterns before enforcing them in production namespaces.
04Runtime Detection and Incident Response
2 sessions · 8 points
Session 1Behavioural Detection for Running Containers
- Deploy behavioural detection rules that alert on unexpected process execution or privilege escalation inside containers.
- Tune detection rules against normal workload behaviour to reduce false positives before enabling automated response.
- Correlate runtime alerts with the image scan and admission history of the affected container.
- Route runtime security alerts into the same incident channel used for infrastructure and application alerts.
Session 2Investigating and Containing a Compromise
- Isolate a suspected compromised pod using network policy and namespace quarantine without destroying forensic evidence.
- Reconstruct an attack timeline from registry, admission controller and runtime detection logs.
- Determine whether a compromise originated in the image, the runtime configuration or an exposed service.
- Document remediation actions and update scanning or admission policy to prevent the same compromise path from recurring.
What the participant receives
4 course modules
A structured syllabus
8 training sessions
across 5 days
32 detailed points
Applied, detailed content
Accredited attendance certificate
On completing the programme
Complete your registration
We will contact you within one business day to confirm.
Ready to start?
Reserve your seat and start building the skill.