Container security

Container security is an advanced and complex topic and yet even for an entry-level KCNA certification, you are expected to know a few basics. As we’ve learned, Namespaced containers are the most commonly used containers and they share the kernel of an underlying OS. That means a process running in a container cannot see other processes running in other containers or processes running on the host. However, all processes running on one host still use the same kernel. If one of the containers gets compromised, there is a chance of the host and all other containers being compromised as well.

Let’s get back to our Docker setup for a quick demonstration. Start an Ubuntu container as we did before and run the uname -r command to see which kernel version is used:

$ docker run -it ubuntu:22.04 bash
root@4a3db7a03ccf:/# uname -r
5.10.47-linuxkit

The output you’ll see depends on your host OS and kernel version. Don’t get surprised if you...