Container Security (Liz Rice)（Z-Library）

【One-Line Pitch】 A practical, mechanism-first guide to securing containerized and cloud native workloads, showing how Linux primitives, image hygiene, orchestration policy, and runtime defenses fit together. Best for engineers, platform/SRE, and security practitioners who already use containers and want to reason about their real attack surface. 【Book Arc】 - **Opening (~0%–10%)**: Establishes the container threat model and security principles, then previews the full map from Linux internals through networking, secrets, and runtime protection. - **Early (~10%–30%)**: Builds the Linux foundation—system calls, permissions, capabilities, control groups, namespaces, and how VMs differ—so later container behavior is explainable rather than magical. - **Middle (~30%–55%)**: Deepens isolation mechanics: cgroup controllers and limits, namespace types (UTS, PID, mount, network, user, IPC, cgroup, time), root-directory changes, and how Kubernetes pods relate to these primitives. - **Late (~55%–85%)**: Moves outward to operational security: dangerous misconfigurations, container-to-container communication, keys/certificates, SPIFFE-style identity, ingress/egress traffic, observability, and secret delivery via environment variables, files, Kubernetes Secrets, CSI drivers, and external operators. - **Ending (~85%–100%)**: Focuses on runtime protection—image runtime policies, network/executable/file/user controls, AI-assisted policy generation, and enforcement technologies such as seccomp, AppArmor, SELinux, ptrace, LD_PRELOAD, and kernel-based security. 【Key Takeaways】 - **Containers are Linux processes with isolation features, not lightweight VMs** (Early): namespaces and root-directory changes explain why a container sees its own hostname, PIDs, mounts, and network while still running on the host kernel. - **Cgroups are the resource-governance layer** (Middle): controllers for CPU, memory, PIDs, and more can cap consumption and even kill a runaway group, which matters for fork bombs, leaks, and resource-exhaustion attacks. - **Capabilities and permissions are central to privilege risk** (Early/Middle): setuid/setgid bits and capabilities such as CAP_NET_RAW can grant extra power; tools like getpcaps and strace help verify what a process actually holds. - **Multitenancy shapes the threat model** (Early): shared hardware and neighboring cloud tenants mean isolation strength and trust boundaries must be chosen deliberately, not assumed. - **Container benefits are conditional, not automatic** (Early): reduced attack surface, limited blast radius, and segregation of duties only hold if configuration, image hygiene, and secret handling are done well. - **Secrets need deliberate delivery and rotation** (Late): storing secrets in images, passing them over the network, or using environment variables each carry trade-offs; Kubernetes Secrets, CSI drivers, and external operators address rotation and access, but root can still read them. - **Runtime security is policy plus enforcement technology** (Late): image runtime policies can constrain network traffic, executables, file access, and user/group IDs, while seccomp, AppArmor, SELinux, ptrace, LD_PRELOAD, and kernel-based tools provide the enforcement hooks. - **Identity and traffic control extend security beyond the container boundary** (Late): keys, certificates, SPIFFE, ingress/egress controls, and network observability are part of the container security story, not separate concerns. 【Reading Tips】 - Deep-read the Linux chapters (cgroups, namespaces, capabilities); they are the conceptual load-bearing walls for everything later. - Skim the table-of-contents-heavy opening and preface material, but note the chapter roadmap so you know where networking, secrets, and runtime protection sit. - Treat the middle isolation chapters as a lab: try unshare, cgroup files, getpcaps, and strace examples to make the abstractions concrete. - For the late chapters, focus on decision criteria—when to use environment variables vs. files vs. CSI drivers, and which runtime enforcement technology fits which threat. - Keep the threat-model framing in mind: ask what credentials, permissions, and network access an attacker would have at each layer. 【Coverage Limits】 The excerpts are heavily weighted toward front matter, chapter listings, and Linux isolation mechanics; later chapters on networking, secrets, and runtime protection are represented mainly by section headings and brief fragments, so this guide cannot verify detailed claims, examples, or chapter conclusions beyond what is listed.