Container Security for Compliant Document Hosting

Why Container Security Matters for Compliance

Containers have become the standard deployment model for modern applications, including those that host and process regulated documents. Docker, Kubernetes, and container orchestration platforms provide flexibility and scalability, but they also introduce security considerations that directly affect compliance.

When containers host personal data or regulated documents, every layer of the container stack -- from the base image to the orchestrator configuration -- becomes part of your compliance surface.

Container Threat Model

Attack Surfaces in Containerized Environments

Attack Surface	Risk	Compliance Impact
Container images	Vulnerable packages, malware, embedded secrets	Data breach, unauthorized access
Container runtime	Container escape, privilege escalation	Unauthorized access to host data
Orchestrator (Kubernetes)	Misconfigured RBAC, exposed API server	Unauthorized data access or modification
Network	Unencrypted pod-to-pod traffic, unrestricted egress	Data interception, unauthorized transfers
Storage	Unencrypted volumes, improper access controls	Data exposure at rest
Registry	Tampered images, unauthorized access	Supply chain compromise
Secrets management	Hardcoded credentials, exposed environment variables	Unauthorized access to data stores

Securing Container Images

Use Minimal Base Images

Start with the smallest possible base image to reduce the attack surface:

• Use distroless images or Alpine-based images instead of full OS images
• Remove build tools, package managers, and shells from production images
• Include only the runtime dependencies your application needs

Scan Images for Vulnerabilities

Integrate vulnerability scanning into your CI/CD pipeline:

• Scan at build time using tools like Trivy, Grype, or Snyk Container
• Block deployment of images with critical or high-severity vulnerabilities
• Scan running images periodically for newly discovered vulnerabilities
• Maintain a vulnerability remediation SLA (e.g., critical within 24 hours, high within 7 days)

Sign and Verify Images

Use image signing to ensure only trusted images are deployed:

• Sign images at build time using Cosign or Notary
• Configure admission controllers (Kyverno, OPA Gatekeeper) to reject unsigned images
• Maintain a record of image signatures for audit purposes

No Secrets in Images

Never embed secrets (API keys, passwords, certificates) in container images:

• Use external secrets management (Kubernetes Secrets with encryption, HashiCorp Vault, AWS Secrets Manager)
• Inject secrets at runtime through environment variables or mounted volumes
• Scan images for accidentally included secrets using tools like TruffleHog or detect-secrets

Runtime Security

Run Containers as Non-Root

Running containers as root gives a compromised container elevated privileges:

• Set runAsNonRoot: true in your pod security context
• Define a specific user ID in your Dockerfile with USER
• Drop all Linux capabilities and add back only what is needed

Use Read-Only File Systems

Prevent runtime modification of the container filesystem:

• Set readOnlyRootFilesystem: true in the security context
• Mount writable volumes only where the application specifically needs them
• This prevents attackers from installing tools or modifying application code at runtime

Resource Limits

Set CPU and memory limits on every container:

• Prevents denial-of-service from runaway processes
• Limits the impact of cryptomining malware
• Ensures fair resource allocation in multi-tenant environments

Pod Security Standards

Apply Kubernetes Pod Security Standards (or Pod Security Policies if on older versions):

• Restricted: The most secure profile; prevents privilege escalation, requires non-root, drops capabilities
• Baseline: Prevents known privilege escalations; reasonable for most workloads
• Privileged: No restrictions; should not be used for compliance-sensitive workloads

Network Security

Network Policies

Implement Kubernetes Network Policies to control pod-to-pod communication:

• Default deny all ingress and egress traffic
• Explicitly allow only required communication paths
• Restrict egress to prevent unauthorized data exfiltration
• Segment networks by data sensitivity level

Encrypt Pod-to-Pod Traffic

Use a service mesh or other mechanism to encrypt all internal communication:

• Deploy Istio, Linkerd, or Cilium for automatic mTLS between pods
• Ensure encryption covers all personal data in transit, including internal traffic
• Monitor for unencrypted communication and alert on violations

Restrict External Access

Control how traffic enters and leaves your cluster:

• Use ingress controllers with TLS termination
• Restrict egress to only approved external endpoints
• Log all external communication for audit purposes
• Use private clusters where possible to eliminate public API server access

Storage Security

Encrypt Persistent Volumes

All persistent storage used by containers must be encrypted:

• Enable encryption at rest on the storage backend (EBS, Azure Disk, GCE Persistent Disk)
• Use customer-managed encryption keys for regulated data
• Ensure encryption configuration is enforced by policy, not left to developer discretion

Access Controls on Volumes

Restrict which pods can access which volumes:

• Use RBAC to control PersistentVolumeClaim creation
• Set appropriate file permissions within volumes
• Do not share volumes between pods unless specifically required
• Use ephemeral volumes for temporary data that should not persist

Logging and Auditing

Audit Logging

Enable comprehensive audit logging:

• Kubernetes API audit logs (capture who did what to which resources)
• Application-level audit logs (capture data access and modification events)
• Container runtime logs (capture container lifecycle events)
• Network flow logs (capture communication patterns)

Log Protection

Protect audit logs from tampering:

• Ship logs to a centralized, append-only logging system outside the cluster
• Encrypt logs in transit and at rest
• Restrict access to the logging system using separate credentials from the application cluster
• Retain logs according to your compliance requirements

Monitoring

Deploy monitoring for security-relevant events:

• Failed authentication attempts
• Privilege escalation events
• Unexpected network connections
• Container image policy violations
• Resource consumption anomalies

Compliance-Specific Configurations

Data Residency in Kubernetes

Ensure your Kubernetes cluster enforces data residency:

• Deploy clusters in compliant regions only
• Use node affinity rules to pin pods processing personal data to nodes in specific regions
• Configure persistent volume provisioning to create volumes in compliant regions
• Verify that the control plane does not replicate data outside the region

Access Management

Implement strong access controls:

• Use RBAC with least-privilege roles
• Require MFA for cluster access
• Audit user and service account permissions regularly
• Use short-lived credentials and rotate them frequently

Secrets Management

Handle secrets appropriately:

• Enable encryption at rest for Kubernetes Secrets (etcd encryption)
• Consider external secrets managers (Vault, AWS Secrets Manager) with Kubernetes integration
• Rotate secrets on a defined schedule
• Audit secret access

Container Compliance Checklist

Area	Control	Status
Images	Vulnerability scanning in CI/CD
Images	Image signing and verification
Images	No embedded secrets
Runtime	Non-root execution
Runtime	Read-only filesystems
Runtime	Resource limits set
Network	Default deny network policies
Network	mTLS for pod-to-pod traffic
Storage	Encrypted persistent volumes
Storage	CMEK for regulated data
Logging	Centralized audit logging
Logging	Tamper-resistant log storage
Access	RBAC with least privilege
Access	MFA for cluster access
Residency	Cluster deployed in compliant region

Partnering Container Security With Compliant Hosting

Building and maintaining a fully compliant container platform for document hosting is a significant investment in engineering and operations. For organizations that need compliant document hosting without the overhead of managing all these container security controls themselves, GlobalDataShield provides a purpose-built platform where these security and compliance controls are handled at the infrastructure level -- letting your engineering team focus on application features rather than container hardening.