Describe common container security attack surfaces and how to secure containers.

• A. Attack surfaces are limited to the host operating system.
• B. Protect images, runtime, and orchestration; attack surfaces include image supply chain, container escape, misconfig; secure by image scanning, least privilege, runtime protection, proper RBAC, network policies.
• C. Containers do not require network policies.
• D. RBAC is not applicable to containers.

Answer: (B)

Container security spans protecting the images you run, the runtime isolation that keeps them separate from the host, and the orchestration or management layer that deploys and configures them. The common attack surfaces show up in three areas: the image supply chain (base images and dependencies can be tainted or outdated), the runtime (a compromised or misconfigured container could escape or break containment), and misconfigurations (too-permissive settings, insecure defaults, or overly broad access in the orchestrator).

To secure containers, address each layer. For images, enforce scanning for known vulnerabilities, use trusted and minimal base images, keep images up to date, and consider signing and verifying image provenance to prevent tampered or unauthorized images from running. For runtime, adopt least-privilege principles (don’t run as root, drop unnecessary capabilities, mount volumes read-only when possible), use isolated namespaces and security profiles (seccomp, AppArmor or SELinux), and enable runtime monitoring to detect unusual container behavior or attempts to escape. For orchestration, implement strict RBAC to control who can deploy or modify workloads, and apply network policies to limit which services and pods can talk to one another. Also remember to manage secrets securely (avoid hard-coding them in images, use secret stores), and enforce configuration hardening to minimize misconfigurations across the stack.

This combination—secure images, hardened runtime, and tightly controlled orchestration with network and access controls—covers the most common container security attack surfaces and how to secure them.