Containers introduce specific security concerns.
Image security:
- Scan images for vulnerabilities (Trivy, Snyk)
- Use minimal base images (distroless, Alpine)
- Don't run as root
- Pin image versions (no :latest in production)
Runtime security:
- Read-only file systems where possible
- Drop unnecessary capabilities
- Use Pod Security Standards/Policies
- Network policies to limit pod communication
Supply chain:
- Sign and verify images
- Use private registries
- Scan dependencies
Interview tip: Mention that you scan images in CI/CD and enforce policies at admission.