Defense in depth layers independent protections so one breach does not expose the entire system. For containers, isolation should be reinforced by non-root execution. section 12.4
A containerized application can be protected by:
- Application-level defenses. section 12.4
- Linux containerization that limits access to the host. section 12.4
- Linux user privileges that prevent a container escape from immediately granting node-level root access. section 12.4
Run a container as non-root
Set runAsNonRoot: true and, when needed, runAsUser: 1001. A matching image USER directive may be required; otherwise Kubernetes can reject the container or the application may fail when binding to port 80. Move the server to port 8080 and target it from the Service.
