Module 07: Security & Optimization

Containers are not secure by default. They share the host kernel, and if compromised, they can become a gateway to your entire infrastructure.

In this module, we move beyond “it works” to “it is secure”. We will deconstruct the layers of container isolation, understand the attack surface, and implement defense-in-depth strategies used by top tech companies.

What You Will Learn

  1. Rootless Docker: Run the Docker daemon without root privileges using User Namespaces.
  2. Seccomp & AppArmor: Restrict the system calls and file access available to a container.
  3. Image Scanning: Detect and block vulnerabilities (CVEs) before they reach production.
  4. Distroless Images: Minimize the attack surface by removing the OS shell and package manager.
  5. Resource Limits: Prevent Denial of Service (DoS) attacks using Cgroups.

Module Chapters