A financial services company hosts multi-tenant microservices handling sensitive transaction processing. Following a penetration test, security assessors demonstrated that a compromised container could exploit a host Linux kernel vulnerability to gain root privileges on the underlying host OS, compromising adjacent containers. To mitigate this specific attack vector while preserving container deployment automation, which of the following controls should the security team implement?
- Deploy sandboxed container runtimes that utilize lightweight virtual machines to isolate each container footprint behind a dedicated kernel boundary.Answer
- BReconfigure default container runtime flags to enforce user namespaces and cgroup memory limits across all pod definitions.
- CImplement host-based microsegmentation firewalls between container worker nodes to block lateral traffic movement across internal VLANs.
- DConfigure role-based access control (RBAC) within the container management dashboard to restrict developer deployment permissions.
Answer
Deploy sandboxed container runtimes that utilize lightweight virtual machines to isolate each container footprint behind a dedicated kernel boundary.
Deploying sandboxed container runtimes (such as Kata Containers or Firecracker) wraps each container workload inside a lightweight virtual machine. This provides a dedicated guest kernel for each container instance, ensuring that even if an attacker executes a kernel exploit inside a container, it cannot escape into the host OS kernel or affect adjacent tenant containers.
Step-by-Step Solution
Key Concept
Container Micro-VM Sandboxing vs. Shared Kernel Isolation