Container Security at Scale: From Build to Runtime

The Container Security Challenge at Enterprise Scale

Your containerized applications are running in production right now with security vulnerabilities you don’t know about. Every image you deploy, every container you run, every registry you trust represents a potential attack vector that traditional security tools can’t adequately protect. Container security isn’t just about scanning images - it’s about securing the entire container lifecycle from build to runtime.

Enterprise container security requires a comprehensive approach that protects your applications without slowing down your deployment velocity or compromising developer experience.

Container Security Lifecycle: Defense in Depth

Container security must be embedded throughout your entire development and deployment pipeline. A single vulnerable dependency or misconfigured runtime policy can compromise your entire cluster.

The Four Pillars of Container Security

1. Build-Time Security

• Static vulnerability scanning with Trivy, Grype, Snyk
• Software Bill of Materials (SBOM) generation and tracking
• Base image security validation and approval
• Secrets scanning and prevention

2. Registry Security

• Image signing and verification with Cosign/Notary
• Access control and vulnerability management
• Admission controller integration
• Supply chain attestation validation

3. Deploy-Time Security

• Runtime security policy enforcement with OPA/Gatekeeper
• Image signature verification before deployment
• Security context validation and least privilege enforcement
• Network policy and service mesh integration

4. Runtime Security

• Behavioral monitoring with Falco and runtime detection
• Process anomaly detection and threat hunting
• Container escape prevention and containment
• Incident response and forensic capabilities

Build-Time Security: Vulnerability Scanning and SBOM

Enterprise Image Scanning with Trivy

Trivy provides comprehensive vulnerability scanning for container images, filesystems, and git repositories with enterprise-grade features for CI/CD integration.

1. CI/CD Pipeline Integration

# .github/workflows/container-security.yml
name: Container Security Scanning

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  container-security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      packages: write

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Container Image
        uses: docker/build-push-action@v5
        with:
          context: .
          load: true
          tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Trivy Vulnerability Scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          exit-code: '1'

      - name: Upload Trivy Results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Generate Vulnerability Report
        run: |
          trivy image --format json --output vulnerability-report.json \
            ${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Fail on Critical Vulnerabilities
        run: |
          CRITICAL=$(jq '.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL") | length' vulnerability-report.json | wc -l)
          HIGH=$(jq '.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH") | length' vulnerability-report.json | wc -l)

          echo "Critical vulnerabilities: $CRITICAL"
          echo "High vulnerabilities: $HIGH"

          if [ "$CRITICAL" -gt 0 ]; then
            echo "❌ Critical vulnerabilities found. Blocking deployment."
            exit 1
          fi

          if [ "$HIGH" -gt 5 ]; then
            echo "⚠️ High vulnerability threshold exceeded ($HIGH > 5)"
            exit 1
          fi

      - name: Generate SBOM
        run: |
          trivy image --format spdx-json --output sbom.spdx.json \
            ${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Upload Security Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: security-reports
          path: |
            vulnerability-report.json
            sbom.spdx.json
            trivy-results.sarif

2. Advanced Trivy Configuration

# .trivyignore
# Ignore specific CVEs after security review
CVE-2023-1234  # False positive in Alpine base image
CVE-2023-5678  # Not exploitable in containerized environment

# trivy.yaml
cache:
  dir: /tmp/trivy-cache
db:
  repository: ghcr.io/aquasecurity/trivy-db

scan:
  security-checks:
    - vuln
    - config
    - secret
  scanners:
    - vuln
    - secret
    - config

vulnerability:
  type:
    - os
    - library

format: sarif
output: /tmp/trivy-results.sarif

secret:
  config: /etc/trivy/secret.yaml

3. Custom Vulnerability Policies

#!/usr/bin/env python3
# scripts/vulnerability-policy-check.py
import json
import sys
from typing import Dict, List
from datetime import datetime, timedelta

class VulnerabilityPolicyEngine:
    def __init__(self, policy_config: str):
        with open(policy_config, 'r') as f:
            self.policy = json.load(f)

    def evaluate_vulnerabilities(self, trivy_report: str) -> Dict:
        """Evaluate vulnerabilities against enterprise security policies"""
        with open(trivy_report, 'r') as f:
            report = json.load(f)

        results = {
            "allowed": True,
            "violations": [],
            "summary": {
                "total_vulnerabilities": 0,
                "critical": 0,
                "high": 0,
                "medium": 0,
                "low": 0,
                "blocked_vulnerabilities": 0
            }
        }

        for result in report.get("Results", []):
            for vuln in result.get("Vulnerabilities", []):
                results["summary"]["total_vulnerabilities"] += 1
                severity = vuln.get("Severity", "UNKNOWN").lower()
                if severity in results["summary"]:
                    results["summary"][severity] += 1

                # Check against policy rules
                violation = self._check_vulnerability_policy(vuln)
                if violation:
                    results["violations"].append(violation)
                    results["summary"]["blocked_vulnerabilities"] += 1

        # Determine if deployment should be blocked
        if results["violations"]:
            results["allowed"] = False

        return results

    def _check_vulnerability_policy(self, vuln: Dict) -> Dict:
        """Check individual vulnerability against policy rules"""
        cve_id = vuln.get("VulnerabilityID", "")
        severity = vuln.get("Severity", "")

        # Check for blocked CVEs
        if cve_id in self.policy.get("blocked_cves", []):
            return {
                "type": "blocked_cve",
                "cve_id": cve_id,
                "severity": severity,
                "reason": f"CVE {cve_id} is explicitly blocked by security policy"
            }

        # Check severity thresholds
        severity_limits = self.policy.get("severity_limits", {})
        if severity in severity_limits:
            # Count existing vulnerabilities of this severity
            current_count = self._count_severity_vulnerabilities(severity)
            if current_count >= severity_limits[severity]:
                return {
                    "type": "severity_threshold",
                    "cve_id": cve_id,
                    "severity": severity,
                    "reason": f"Severity threshold exceeded: {current_count} >= {severity_limits[severity]}"
                }

        # Check for unpatched vulnerabilities older than policy allows
        if vuln.get("PublishedDate"):
            published_date = datetime.fromisoformat(vuln["PublishedDate"].replace("Z", "+00:00"))
            max_age_days = self.policy.get("max_vulnerability_age_days", {}).get(severity, 365)

            if (datetime.now() - published_date).days > max_age_days:
                return {
                    "type": "vulnerability_age",
                    "cve_id": cve_id,
                    "severity": severity,
                    "reason": f"Vulnerability older than {max_age_days} days policy limit"
                }

        return None

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: vulnerability-policy-check.py <policy.json> <trivy-report.json>")
        sys.exit(1)

    engine = VulnerabilityPolicyEngine(sys.argv[1])
    results = engine.evaluate_vulnerabilities(sys.argv[2])

    print(json.dumps(results, indent=2))

    if not results["allowed"]:
        print(f"\n❌ Policy violations found: {len(results['violations'])}")
        sys.exit(1)
    else:
        print(f"\n✅ All vulnerability policies passed")

Multi-Scanner Approach with Grype and Snyk

# .github/workflows/multi-scanner-security.yml
name: Multi-Scanner Container Security

jobs:
  vulnerability-scanning:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        scanner: [trivy, grype, snyk]

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Build Test Image
        run: |
          docker build -t test-image:${{ github.sha }} .

      - name: Trivy Scan
        if: matrix.scanner == 'trivy'
        run: |
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy image --format json --output trivy-results.json \
            test-image:${{ github.sha }}

      - name: Grype Scan
        if: matrix.scanner == 'grype'
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
          grype test-image:${{ github.sha }} -o json > grype-results.json

      - name: Snyk Scan
        if: matrix.scanner == 'snyk'
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          npm install -g snyk
          snyk container test test-image:${{ github.sha }} --json > snyk-results.json

      - name: Normalize Results
        run: |
          python3 scripts/normalize-scanner-results.py \
            --scanner ${{ matrix.scanner }} \
            --input ${{ matrix.scanner }}-results.json \
            --output normalized-${{ matrix.scanner }}.json

      - name: Upload Scanner Results
        uses: actions/upload-artifact@v3
        with:
          name: scanner-results-${{ matrix.scanner }}
          path: normalized-${{ matrix.scanner }}.json

  aggregate-results:
    needs: vulnerability-scanning
    runs-on: ubuntu-latest
    steps:
      - name: Download All Scanner Results
        uses: actions/download-artifact@v3

      - name: Aggregate and Deduplicate
        run: |
          python3 scripts/aggregate-vulnerability-results.py \
            --input-dir . \
            --output aggregated-vulnerabilities.json

      - name: Generate Security Report
        run: |
          python3 scripts/generate-security-report.py \
            --vulnerabilities aggregated-vulnerabilities.json \
            --template enterprise-security-report.html \
            --output security-report.html

Registry Security and Supply Chain Protection

Container Registry Security Configuration

1. Harbor Enterprise Registry Setup

# harbor/docker-compose.yml
version: '3.8'
services:
  harbor-core:
    image: goharbor/harbor-core:v2.9.0
    environment:
      - CORE_SECRET=ChangeMePlease
      - JOBSERVICE_SECRET=ChangeMePlease
    volumes:
      - harbor-config:/etc/harbor
      - harbor-data:/data
    ports:
      - '443:8443'
    depends_on:
      - harbor-db
      - redis

  harbor-db:
    image: goharbor/harbor-db:v2.9.0
    environment:
      - POSTGRES_PASSWORD=ChangeMePlease
    volumes:
      - harbor-db:/var/lib/postgresql/data

  redis:
    image: goharbor/redis-photon:v2.9.0
    volumes:
      - redis-data:/var/lib/redis

  trivy-adapter:
    image: goharbor/trivy-adapter-photon:v2.9.0
    environment:
      - SCANNER_TRIVY_CACHE_DIR=/home/scanner/.cache/trivy
      - SCANNER_TRIVY_REPORTS_DIR=/home/scanner/.cache/reports
    volumes:
      - trivy-cache:/home/scanner/.cache

volumes:
  harbor-config:
  harbor-data:
  harbor-db:
  redis-data:
  trivy-cache:

2. Image Signing with Cosign

#!/bin/bash
# scripts/sign-and-verify-images.sh

set -e

IMAGE_NAME="$1"
IMAGE_TAG="$2"
FULL_IMAGE="${IMAGE_NAME}:${IMAGE_TAG}"

echo "🔐 Signing container image: ${FULL_IMAGE}"

# Generate key pair (for demo - use proper key management in production)
if [[ ! -f cosign.key ]]; then
    cosign generate-key-pair
fi

# Sign the image
cosign sign --key cosign.key ${FULL_IMAGE}

# Generate and sign SBOM attestation
syft ${FULL_IMAGE} -o spdx-json > sbom.spdx.json
cosign attest --key cosign.key --predicate sbom.spdx.json ${FULL_IMAGE}

# Verify signature
echo "✅ Verifying image signature..."
cosign verify --key cosign.pub ${FULL_IMAGE}

# Verify SBOM attestation
echo "✅ Verifying SBOM attestation..."
cosign verify-attestation --key cosign.pub ${FULL_IMAGE}

echo "🎉 Image ${FULL_IMAGE} successfully signed and verified!"

3. Admission Controller for Signed Images

# admission-controller/cosign-policy.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cosign-verification-policy
  namespace: cosign-system
data:
  policy.yaml: |
    apiVersion: v1alpha1
    kind: ClusterImagePolicy
    metadata:
      name: enterprise-image-policy
    spec:
      images:
      - glob: "registry.company.com/**"
        keyless:
          ca-cert: |
            -----BEGIN CERTIFICATE-----
            <CERTIFICATE_DATA>
            -----END CERTIFICATE-----
          rekor-url: https://rekor.sigstore.dev
      - glob: "ghcr.io/company/**"
        publicKey: |
          -----BEGIN PUBLIC KEY-----
          <PUBLIC_KEY_DATA>
          -----END PUBLIC KEY-----
      - glob: "docker.io/library/**"
        keyless:
          ca-cert: |
            -----BEGIN CERTIFICATE-----
            <TRUSTED_CA_CERTIFICATE>
            -----END CERTIFICATE-----
          rekor-url: https://rekor.sigstore.dev
      policy:
        type: "cue"
        data: |
          import "time"
          
          // Require signatures for all images
          authorizations: [{
            keyless: {
              url: string
              ca_cert: string
            }
          } | {
            public_key: string
          }]
          
          // Additional attestation requirements
          attestations: [{
            name: "sbom"
            predicate_type: "https://spdx.dev/Document"
            policy: {
              type: "cue"
              data: """
                predicate: {
                  Data: {
                    SPDXID: "SPDXRef-DOCUMENT"
                    documentNamespace: =~"^https://sbom.example/.*"
                  }
                }
              """
            }
          }]

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cosign-webhook
  namespace: cosign-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cosign-webhook
  template:
    metadata:
      labels:
        app: cosign-webhook
    spec:
      containers:
        - name: cosign-webhook
          image: gcr.io/projectsigstore/cosign/cosign-webhook:latest
          env:
            - name: TUF_ROOT
              value: '/var/lib/tuf-root'
            - name: WEBHOOK_SECRET_NAME
              value: 'cosign-webhook-secret'
          volumeMounts:
            - name: cosign-policy
              mountPath: /etc/cosign
            - name: tuf-root
              mountPath: /var/lib/tuf-root
          ports:
            - containerPort: 8443
          resources:
            requests:
              memory: '128Mi'
              cpu: '100m'
            limits:
              memory: '256Mi'
              cpu: '200m'
      volumes:
        - name: cosign-policy
          configMap:
            name: cosign-verification-policy
        - name: tuf-root
          emptyDir: {}

Runtime Security with Falco

Falco Configuration for Enterprise Monitoring

1. Falco Rules for Container Security

# falco-rules/container-security.yaml
- rule: Unauthorized Container Image
  desc: Detect containers running from unauthorized registries
  condition: >
    container and 
    not k8s_container_image_repository in (authorized_registries) and
    not k8s_container_image_repository startswith "registry.company.com/"
  output: >
    Unauthorized container image 
    (image=%k8s.container.image repository=%k8s.container.image.repository 
     pod=%k8s.pod.name namespace=%k8s.ns.name)
  priority: HIGH
  tags: [container, supply-chain, k8s]

- list: authorized_registries
  items:
    - 'registry.company.com'
    - 'ghcr.io/company'
    - 'docker.io/library'
    - 'registry.k8s.io'

- rule: Container Privilege Escalation
  desc: Detect attempts to escalate privileges within containers
  condition: >
    spawned_process and
    container and
    proc.name in (privilege_escalation_binaries)
  output: >
    Privilege escalation attempt in container 
    (command=%proc.cmdline pid=%proc.pid container=%container.name 
     image=%container.image.repository)
  priority: CRITICAL
  tags: [privilege-escalation, container]

- list: privilege_escalation_binaries
  items: [sudo, su, doas, pkexec, newgrp, sg]

- rule: Container Escape Attempt
  desc: Detect potential container escape attempts
  condition: >
    spawned_process and
    container and
    proc.name in (container_escape_binaries) and
    proc.args contains /proc/self/root
  output: >
    Container escape attempt detected 
    (command=%proc.cmdline container=%container.name 
     image=%container.image.repository)
  priority: CRITICAL
  tags: [container-escape, container]

- list: container_escape_binaries
  items: [unshare, nsenter, docker, runc, kubectl]

- rule: Suspicious File Access in Container
  desc: Detect access to sensitive files from containers
  condition: >
    open_read and
    container and
    fd.name in (sensitive_files) and
    not proc.name in (allowed_processes)
  output: >
    Suspicious file access in container 
    (file=%fd.name process=%proc.name container=%container.name)
  priority: HIGH
  tags: [filesystem, container]

- list: sensitive_files
  items:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - /root/.ssh/authorized_keys
    - /home/*/.ssh/authorized_keys

- list: allowed_processes
  items: [sshd, systemd, init]

2. Falco Deployment with Sidekiq Integration

# falco-deployment.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: falco-system
spec:
  selector:
    matchLabels:
      app: falco
  template:
    metadata:
      labels:
        app: falco
    spec:
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      containers:
        - name: falco
          image: falcosecurity/falco:0.36.0
          args:
            - /usr/bin/falco
            - --cri=/host/run/containerd/containerd.sock
            - --cri=/host/run/crio/crio.sock
            - -K=/var/run/secrets/kubernetes.io/serviceaccount/token
            - -k=https://kubernetes.default
            - --k8s-node=$(FALCO_K8S_NODE_NAME)
            - -pk
          env:
            - name: FALCO_K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: FALCO_BPF_PROBE
              value: ''
          volumeMounts:
            - mountPath: /host/var/run/docker.sock
              name: docker-socket
            - mountPath: /host/run/containerd/containerd.sock
              name: containerd-socket
            - mountPath: /host/run/crio/crio.sock
              name: crio-socket
            - mountPath: /host/dev
              name: dev-fs
            - mountPath: /host/proc
              name: proc-fs
              readOnly: true
            - mountPath: /host/boot
              name: boot-fs
              readOnly: true
            - mountPath: /host/lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /host/usr
              name: usr-fs
              readOnly: true
            - mountPath: /host/etc
              name: etc-fs
              readOnly: true
            - mountPath: /etc/falco
              name: falco-config
          securityContext:
            privileged: true
          resources:
            requests:
              memory: '512Mi'
              cpu: '100m'
            limits:
              memory: '1Gi'
              cpu: '1000m'
      volumes:
        - name: docker-socket
          hostPath:
            path: /var/run/docker.sock
        - name: containerd-socket
          hostPath:
            path: /run/containerd/containerd.sock
        - name: crio-socket
          hostPath:
            path: /run/crio/crio.sock
        - name: dev-fs
          hostPath:
            path: /dev
        - name: proc-fs
          hostPath:
            path: /proc
        - name: boot-fs
          hostPath:
            path: /boot
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: usr-fs
          hostPath:
            path: /usr
        - name: etc-fs
          hostPath:
            path: /etc
        - name: falco-config
          configMap:
            name: falco-config

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-config
  namespace: falco-system
data:
  falco.yaml: |
    rules_file:
      - /etc/falco/falco_rules.yaml
      - /etc/falco/container-security.yaml

    time_format_iso_8601: true
    json_output: true
    json_include_output_property: true
    json_include_tags_property: true

    http_output:
      enabled: true
      url: "http://falco-sidekiq.falco-system.svc.cluster.local:2801/"
      user_agent: "falco/0.36.0"

    grpc:
      enabled: true
      bind_address: "0.0.0.0:5060"
      threadiness: 8

    grpc_output:
      enabled: true

    syscall_event_drops:
      actions:
        - log
        - alert
      rate: 0.03333
      max_burst: 1000

    priority: debug
    buffered_outputs: false

    outputs:
      rate: 0
      max_burst: 1000

  container-security.yaml: |
    # Include the container security rules from above

3. Falco Sidekiq Integration for Real-time Alerts

# falco-sidekiq/alert_processor.py
import json
import asyncio
import aioredis
from datetime import datetime
from typing import Dict, Any
from aiohttp import web, ClientSession
import logging

class FalcoAlertProcessor:
    def __init__(self, redis_url: str, slack_webhook: str):
        self.redis_url = redis_url
        self.slack_webhook = slack_webhook
        self.logger = logging.getLogger(__name__)

    async def process_alert(self, alert: Dict[Any, Any]) -> None:
        """Process incoming Falco alert and trigger appropriate responses"""

        alert_id = f"falco-{datetime.now().isoformat()}-{hash(str(alert))}"
        priority = alert.get("priority", "INFO")
        rule = alert.get("rule", "Unknown")

        # Store alert in Redis for deduplication
        redis = await aioredis.from_url(self.redis_url)
        await redis.setex(alert_id, 3600, json.dumps(alert))

        # Check for alert deduplication
        if await self._is_duplicate_alert(redis, alert):
            self.logger.info(f"Duplicate alert ignored: {rule}")
            return

        # Process based on severity
        if priority in ["CRITICAL", "HIGH"]:
            await self._handle_critical_alert(alert)
        elif priority == "MEDIUM":
            await self._handle_medium_alert(alert)
        else:
            await self._handle_low_alert(alert)

        await redis.close()

    async def _is_duplicate_alert(self, redis, alert: Dict) -> bool:
        """Check if similar alert was recently processed"""
        rule = alert.get("rule", "")
        container = alert.get("output_fields", {}).get("container.name", "")

        # Create deduplication key
        dedup_key = f"dedup:{rule}:{container}"

        # Check if we've seen this combination recently (5 minutes)
        if await redis.get(dedup_key):
            return True

        # Set deduplication marker
        await redis.setex(dedup_key, 300, "1")
        return False

    async def _handle_critical_alert(self, alert: Dict) -> None:
        """Handle critical security alerts with immediate response"""

        # Send immediate Slack notification
        await self._send_slack_alert(alert, "🚨 CRITICAL SECURITY ALERT")

        # Create incident in PagerDuty
        await self._create_pagerduty_incident(alert)

        # Execute automated response if configured
        await self._execute_automated_response(alert)

    async def _handle_medium_alert(self, alert: Dict) -> None:
        """Handle medium priority alerts with team notification"""
        await self._send_slack_alert(alert, "⚠️ Security Alert")

        # Log to SIEM
        await self._send_to_siem(alert)

    async def _handle_low_alert(self, alert: Dict) -> None:
        """Handle low priority alerts with logging"""
        await self._send_to_siem(alert)

    async def _send_slack_alert(self, alert: Dict, prefix: str) -> None:
        """Send formatted alert to Slack"""
        output = alert.get("output", "Unknown security event")
        priority = alert.get("priority", "INFO")
        rule = alert.get("rule", "Unknown rule")

        message = {
            "text": f"{prefix}: {rule}",
            "attachments": [{
                "color": "danger" if priority in ["CRITICAL", "HIGH"] else "warning",
                "fields": [
                    {"title": "Rule", "value": rule, "short": True},
                    {"title": "Priority", "value": priority, "short": True},
                    {"title": "Details", "value": output, "short": False}
                ],
                "ts": alert.get("time", datetime.now().timestamp())
            }]
        }

        async with ClientSession() as session:
            await session.post(self.slack_webhook, json=message)

    async def _create_pagerduty_incident(self, alert: Dict) -> None:
        """Create PagerDuty incident for critical alerts"""
        # PagerDuty integration implementation
        pass

    async def _execute_automated_response(self, alert: Dict) -> None:
        """Execute automated containment responses"""
        rule = alert.get("rule", "")

        if "Container Escape" in rule:
            await self._quarantine_container(alert)
        elif "Privilege Escalation" in rule:
            await self._terminate_process(alert)

    async def _quarantine_container(self, alert: Dict) -> None:
        """Quarantine container by applying network policy"""
        # Kubernetes API integration to apply quarantine network policy
        pass

    async def _send_to_siem(self, alert: Dict) -> None:
        """Send alert to SIEM system"""
        # SIEM integration implementation
        pass

# Web server to receive Falco webhooks
app = web.Application()
processor = FalcoAlertProcessor(
    redis_url="redis://redis.falco-system.svc.cluster.local:6379",
    slack_webhook="https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"
)

async def handle_falco_webhook(request):
    """Handle incoming Falco webhook"""
    alert = await request.json()
    await processor.process_alert(alert)
    return web.Response(text="OK")

app.router.add_post('/', handle_falco_webhook)

if __name__ == '__main__':
    web.run_app(app, host='0.0.0.0', port=2801)

Enterprise Container Security Policy Framework

Kubernetes Security Policies with OPA Gatekeeper

# security-policies/container-security-baseline.yaml
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8scontainersecuritybaseline
spec:
  crd:
    spec:
      names:
        kind: K8sContainerSecurityBaseline
      validation:
        properties:
          allowedRegistries:
            type: array
            items:
              type: string
          requiredLabels:
            type: array
            items:
              type: string
          maxCriticalVulns:
            type: integer
          maxHighVulns:
            type: integer
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainersecuritybaseline

        # Deny unsigned images
        violation[{"msg": "Container image must be signed"}] {
          input.review.object.spec.containers[_].image
          not image_has_signature(input.review.object.spec.containers[_].image)
        }

        # Restrict to allowed registries
        violation[{"msg": "Container image from unauthorized registry"}] {
          container := input.review.object.spec.containers[_]
          not registry_allowed(container.image, input.parameters.allowedRegistries)
        }

        # Deny privileged containers
        violation[{"msg": "Privileged containers are prohibited"}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
        }

        # Require non-root user
        violation[{"msg": "Containers must run as non-root"}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.runAsUser == 0
        }

        # Require resource limits
        violation[{"msg": "Container must have resource limits"}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits
        }

        # Check vulnerability limits
        violation[{"msg": "Image exceeds vulnerability thresholds"}] {
          container := input.review.object.spec.containers[_]
          vuln_count := get_vulnerability_count(container.image)
          vuln_count.critical > input.parameters.maxCriticalVulns
        }

        # Helper functions
        registry_allowed(image, allowed_registries) {
          registry := split(image, "/")[0]
          registry == allowed_registries[_]
        }

        image_has_signature(image) {
          # Integration with cosign verification
          # This would need to be implemented with external data provider
          true
        }

        get_vulnerability_count(image) = count {
          # Integration with vulnerability scanner
          # This would need to be implemented with external data provider
          count := {"critical": 0, "high": 0}
        }

---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerSecurityBaseline
metadata:
  name: container-security-baseline
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Pod']
      - apiGroups: ['apps']
        kinds: ['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet']
    namespaces: ['production', 'staging']
    excludedNamespaces: ['kube-system', 'falco-system', 'gatekeeper-system']
  parameters:
    allowedRegistries:
      - 'registry.company.com'
      - 'ghcr.io/company'
      - 'registry.k8s.io'
    requiredLabels:
      - 'app'
      - 'version'
      - 'environment'
    maxCriticalVulns: 0
    maxHighVulns: 5

Performance Impact and Optimization

Container Security Performance Metrics

Security Component	Overhead	Optimization Strategy
Image Scanning	2-5 minutes build time	Layer caching, incremental scans
Runtime Monitoring	5-10% CPU overhead	eBPF optimization, filtering
Policy Validation	100-500ms per admission	Policy compilation, caching
Image Signing	30-60 seconds	Keyless signing, parallel ops
Total Impact	10-15% overall	Optimized toolchain integration

Cost-Benefit Analysis

Implementation Costs:

• Security tooling licenses: $50K-100K annually
• Engineering implementation: 4-6 months
• Infrastructure overhead: 15-20% additional compute
• Training and processes: 2-3 months

Business Benefits:

• 85% reduction in container vulnerabilities reaching production
• 70% faster incident response for container security issues
• 60% reduction in compliance audit preparation time
• 40% improvement in developer security awareness

ROI Calculation:

# Annual container security value
PREVENTED_CONTAINER_INCIDENTS = 18    # per year
AVERAGE_CONTAINER_INCIDENT_COST = 200000  # USD
COMPLIANCE_SAVINGS = 250000          # USD annually

TOTAL_SAVINGS = (PREVENTED_CONTAINER_INCIDENTS * AVERAGE_CONTAINER_INCIDENT_COST) + COMPLIANCE_SAVINGS
# Total Savings: $3,850,000 annually

IMPLEMENTATION_COST = 500000  # Total first year
ROI = ((TOTAL_SAVINGS - IMPLEMENTATION_COST) / IMPLEMENTATION_COST) * 100
# ROI: 670% in first year

Conclusion

Container security at enterprise scale requires a comprehensive, lifecycle-based approach that integrates seamlessly with your development and deployment workflows. By implementing the tools and practices outlined in this guide, you create a defense-in-depth strategy that protects your containerized applications without compromising deployment velocity.

The key to successful container security lies in automation, integration, and continuous monitoring. Start with vulnerability scanning in your CI/CD pipeline, add runtime monitoring with Falco, and progressively implement policy enforcement and supply chain security.

Remember that container security is not a one-time implementation - it’s an ongoing practice that evolves with your applications and threat landscape. Focus on building security into your development culture, not just your toolchain.

Your container security journey starts with scanning your first image. Begin today.