Attack Surface: Containers & Kubernetes
Container attack surface
Containers are ephemeral. Attacks are not. ManySignal's eBPF sensors capture every process execution, network connection, and filesystem event before the container terminates — enabling investigation of incidents that live for seconds.
Kubernetes attack vectors from image to cluster
Container images
T1610Malicious base images, embedded backdoors, vulnerable packages
Container runtime
T1611Escape via privileged containers, volume mounts, Docker socket
Kubernetes API server
T1078.001Unauthorized API access, RBAC privilege escalation
Pod-to-pod network
T1021Lateral movement within cluster via misconfigured NetworkPolicy
Secrets management
T1552.007Kubernetes secrets in etcd, mounted secrets exfiltration
Node access
T1068Node compromise enabling container escape to host
Top 5 detection rules
monitoring_layers:
image_layer:
- registry_scan: grype + trivy for CVE detection
- signature_verification: cosign + sigstore
- base_image_monitoring: upstream_compromise_alerts
runtime_layer:
- ebpf_sensor: falco rules + tetragon policies
- syscall_monitoring: all container processes
- network_monitoring: pod egress + inter-pod
- filesystem_monitoring: sensitive_path access
orchestration_layer:
- k8s_audit_log: all API server events
- rbac_monitoring: privilege changes + new bindings
- secret_access: who reads which secrets + when
- admission_webhook: policy enforcement + alerting
response:
- pod_isolation: NetworkPolicy + node cordon
- evidence_capture: snapshot before termination
- image_block: add to admission deny listRelated use cases
Container attack surface FAQ
What runtime security sensors does ManySignal use for container monitoring?
ManySignal integrates with Falco (rules-based container security), Tetragon (eBPF-native process and network observability), and cloud provider container security services (Amazon GuardDuty EKS, GCP Security Command Center, Microsoft Defender for Containers). The eBPF layer provides system call visibility without kernel module installation, enabling monitoring of all container processes without performance impact.
How does ManySignal detect container escape attempts?
Container escape detection monitors for: process executions that break out of cgroup boundaries, mount namespace violations (accessing host filesystems), Docker socket access from within containers, privileged container capabilities being exploited, and kernel exploit patterns (CVE-specific syscall sequences). When escape is confirmed via namespace validation, the alert is classified as critical and the pod is isolated.
Can ManySignal monitor Kubernetes RBAC for privilege abuse?
Yes. ManySignal ingests Kubernetes audit logs and monitors for: ClusterRoleBinding creation granting cluster-admin, ServiceAccount token creation by non-authorized entities, wildcard resource permissions, privileged namespace access, and RBAC changes made outside of approved GitOps workflows. RBAC changes are correlated with the identity making them and the time context.
How does ManySignal handle the ephemeral nature of containers for forensic investigation?
ManySignal's eBPF sensors capture all process execution, network, and file system events from containers in real-time and store them in the investigation timeline before container termination. Pod metadata (image, namespace, labels, node) is captured at alert time. This enables full forensic investigation of container compromise events even when the container no longer exists.
How does ManySignal detect malicious container images before they run in production?
ManySignal integrates with container registry webhooks (ECR, GCR, Docker Hub) and can trigger image scanning via integrated vulnerability scanners on push. Images containing known-malicious binaries (hash matches), critical unpatched CVEs in exposed services, or embedded secrets are flagged before admission to the deployment registry. The registry block policy is configurable — alert-only, require approval, or hard block.
Does ManySignal support service mesh environments with Istio or Linkerd?
Yes. ManySignal ingests Envoy and Linkerd proxy access logs from service meshes, providing application-layer visibility into east-west traffic within the Kubernetes cluster. Service-to-service communication that violates declared mesh policy, unexpected service calls introduced after a new deployment, and anomalous request rates between services are all detectable via service mesh telemetry.
What is the performance overhead of ManySignal's eBPF container monitoring?
The eBPF-based monitoring adds less than 2% CPU overhead and under 100 MB memory per node in typical Kubernetes environments. There are no application code changes required and no sidecar containers injected. For performance-sensitive workloads, specific namespaces or workloads can be excluded from deep eBPF monitoring while still receiving event log-based coverage.
How does ManySignal handle container security compliance requirements for PCI DSS and CIS Benchmarks?
ManySignal's Kubernetes and container coverage includes CIS Kubernetes Benchmark checks (API server configuration, etcd security, kubelet configuration, network policy enforcement) and maps container security findings to PCI DSS requirements for system component monitoring (Requirement 10) and vulnerability management (Requirement 6). The compliance posture dashboard shows current container security posture against these benchmarks in real time.
Capture every container event before the pod terminates
eBPF runtime monitoring, Kubernetes audit logs, and RBAC analysis — full container security from image to node.