<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: implementing-container-security-testing
name: implementing-container-security-testing
description: "Techniques and methodologies for implementing container security testing"
subdomain: security-testing
title: "Implementing Container Security Testing"
description: "Techniques and methodologies for implementing container security testing"
tags:
  - container-security
  - Docker
  - Kubernetes
  - image-scanning
  - runtime-security
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Container Security Testing

> Build comprehensive security testing pipelines for container images, orchestration platforms, and runtime environments including Docker and Kubernetes.

## Overview

Container security testing validates the security of container images, orchestration configurations, and runtime behavior. This technique covers image vulnerability scanning, Kubernetes security assessment, runtime monitoring, and supply chain verification.

## Core Concepts

- **Image scanning**: Detect CVEs, misconfigurations, and embedded secrets in container images
- **Kubernetes hardening**: Assess RBAC, network policies, pod security standards
- **Runtime monitoring**: Detect anomalous container behavior (exec, mount, network)
- **Supply chain verification**: Validate image provenance and signature chains
- **CIS Benchmarks**: Automated compliance checking against Docker/K8s CIS benchmarks

## Workflow

1. Inventory container images and orchestration platforms
2. Scan container images for CVEs and misconfigurations
3. Check Dockerfiles for security anti-patterns
4. Assess Kubernetes RBAC and pod security configurations
5. Test network policy enforcement and segmentation
6. Validate secrets management (no hardcoded credentials)
7. Test container runtime security controls
8. Verify image signing and supply chain integrity
9. Run CIS benchmark compliance checks
10. Generate findings report with prioritized remediation

## Implementation

```python
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class ContainerRisk(Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"


@dataclass
class ImageScanResult:
    image: str
    tag: str
    vulnerabilities: list[dict] = field(default_factory=list)
    misconfigurations: list[dict] = field(default_factory=list)
    secrets_found: list[str] = field(default_factory=list)

    @property
    def critical_vulns(self) -> int:
        return sum(1 for v in self.vulnerabilities if v.get("severity") == "critical")

    @property
    def risk_level(self) -> ContainerRisk:
        if self.critical_vulns > 0 or self.secrets_found:
            return ContainerRisk.CRITICAL
        high = sum(1 for v in self.vulnerabilities if v.get("severity") == "high")
        if high > 5:
            return ContainerRisk.HIGH
        if self.misconfigurations:
            return ContainerRisk.MEDIUM
        return ContainerRisk.LOW


class ContainerSecurityTester:
    """Container security testing framework."""

    def __init__(self) -> None:
        self.scan_results: list[ImageScanResult] = []
        self.k8s_findings: list[dict] = []

    def add_scan_result(self, result: ImageScanResult) -> None:
        self.scan_results.append(result)

    def add_k8s_finding(self, category: str, severity: str, resource: str, detail: str) -> None:
        self.k8s_findings.append({
            "category": category, "severity": severity,
            "resource": resource, "detail": detail,
        })

    def high_risk_images(self) -> list[ImageScanResult]:
        return [r for r in self.scan_results if r.risk_level in (ContainerRisk.CRITICAL, ContainerRisk.HIGH)]

    def test_summary(self) -> dict:
        return {
            "images_scanned": len(self.scan_results),
            "high_risk_images": len(self.high_risk_images()),
            "total_vulns": sum(len(r.vulnerabilities) for r in self.scan_results),
            "k8s_findings": len(self.k8s_findings),
            "secrets_exposed": sum(len(r.secrets_found) for r in self.scan_results),
        }
```

## Best Practices

- Scan images in CI/CD pipelines before they reach registries
- Use distroless or scratch base images to minimize attack surface
- Enforce pod security standards—don't run containers as root
- Test network policies with actual traffic—policy existence doesn't mean enforcement
- Verify image signatures in admission controllers, not just at build time
- Monitor runtime behavior—static scanning misses zero-days and logic flaws

## Detection

```yaml
title: Container Security Testing Detection
id: 115d00f4-2da9-420d-88ad-8f4dd0c69ad0
status: experimental
description: Detects suspicious activity related to implementing container security testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*container*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Security Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Related Techniques

- [Building Security Testing Methodology](../building-security-testing-methodology/SKILL.md)
- [Performing Database Security Testing](../performing-database-security-testing/SKILL.md)
