An organization is migrating sensitive financial API workloads from traditional virtual machines to an unmanaged container orchestration cluster hosted on bare-metal servers. During a security architecture review, the security team expresses concern that a container compromise could lead to host kernel exploitation or unauthorized lateral movement between isolated tenant containers. Which TWO of the following technical controls directly mitigate these runtime isolation risks at the host level?
- Configuring user namespaces (userns) on the container daemon to map container root permissions to an unprivileged non-root UID on the host host systemAnswer
- BDeploying web application firewalls (WAF) at the ingress gateway to inspect incoming HTTP/HTTPS requests before routing to container endpoints
- Enforcing secure computing mode (seccomp) profiles to restrict the specific system calls containerized processes can make to the host kernelAnswer
- DApplying TLS 1.3 encryption for all inter-container traffic passing across the internal physical network interface
Answer
The correct controls are mapping container root accounts to unprivileged host users via user namespaces and restricting system calls via seccomp profiles.
Containers share the host kernel. To protect the host operating system from container-based threats, security controls must restrict host-level privileges and kernel access. User namespaces prevent a containerized root user from possessing administrative access on the host, while seccomp restricts the syscalls that container processes can issue to the kernel.
Step-by-Step Solution
Key Concept
Container Security and Host Kernel Isolation Mechanisms