Container and Kubernetes hardening

Container and Kubernetes hardeningthe floor, even when you also have a stronger boundary

Whatever primitive you choose, the container itself should be locked down. These are cheap, well-understood controls and skipping them is what turns a contained process into a host-level foothold.

• Drop all Linux capabilities, then add back only the few a workload genuinely needs.
• Run as a non-root user with a read-only root filesystem; mount writable scratch only where required.
• Apply a seccomp profile to deny the dangerous syscalls the workload never calls.
• Enforce network policy: default-deny egress, so an escaped process can't reach the metadata endpoint or your internal services.
• Forbid privileged pods, host-path mounts and host networking - these dissolve the boundary entirely.