OSS
/oss/en/openforge/standards/container-iac-security

Container, Kubernetes & IaC Security

Hardened container images, non-root execution, NetworkPolicies, and policy-as-code.

Container, Kubernetes & IaC Security

Cloud-native workloads must be strictly isolated across container runtimes and Kubernetes clusters.

Security Baseline

  • Multi-Stage Builds: Compile in builder stages and copy only runtime binaries to minimal base images.
  • Non-Root Execution: Workloads execute explicitly as non-root users (USER 65532).
  • Read-Only Root Filesystem: Immutability enforced with readOnlyRootFilesystem: true.
  • NetworkPolicy Enforcement: Default-deny ingress/egress policies restricting east-west traffic.
  • PodDisruptionBudgets: PDBs configured to guarantee availability during maintenance.

Canonical Source