Container Security

What's in this pack

This pack assembles the six open-source tools most teams converge on after dropping commercial container-security platforms. Together they cover registry storage, image scanning, infra-as-code linting, and runtime defense — the four layers that show up in every supply-chain breach post-mortem.

The split matters: registry without scan is theater, scan without SBOM gives you CVE numbers but no remediation surface, runtime without network policy can detect intrusion but can't contain blast radius.

Why container security matters now

The 2024-2025 wave of supply-chain incidents (xz-utils, polyfill.io, npm worm campaigns) made one thing concrete: the binary you ship is the sum of every dependency you didn't audit. A modern container image pulls from base OS, language runtime, app layer, and build tooling — four supply chains stacked on each other. The cost of one compromised transitive dep is the same whether you're a 5-person startup or a Fortune 500.

Commercial scanners (Snyk, Wiz, Aqua) work, but they want $30-100 per node per month and ship telemetry to their cloud. The open-source pack here delivers:

• Pre-merge IaC scanning (Checkov in CI catches misconfigured S3 buckets, missing securityContext, exposed secrets before review)
• Post-build image scanning (Grype + Syft on every push to Harbor — fail the build if CVSS ≥ 7)
• Runtime defense (CrowdSec ingests nginx/Traefik logs and shares attacker IPs with 100k+ peers)
• Network containment (Cilium NetworkPolicy means a compromised pod can't pivot to your DB)

Install in one command

# Install the entire pack into the current project
tokrepo install pack/container-security

# Or pick individual assets
tokrepo install grype
tokrepo install checkov

The TokRepo CLI writes scanner configs, CI job templates, and Helm value snippets into your repo. Each asset's page documents the actual flags Anchore, Bridgecrew, Isovalent, and the Harbor team recommend for production.

Common pitfalls

• Running Grype against latest tags only. Pin to digests in production manifests; latest drifts and your scan history becomes meaningless.
• Treating CVSS score as priority. A CVSS 9.8 in a dev-only base image you never expose is lower priority than a CVSS 6.5 in your edge proxy. Combine Grype output with reachability analysis from your runtime.
• Skipping SBOM generation. When the next xz-style backdoor lands, the teams that already have Syft SBOMs in artifact storage answer "are we exposed?" in minutes. Teams without SBOMs spend a week.
• Checkov as the only IaC gate. Checkov is excellent at known-bad-pattern detection but won't catch business-logic security (e.g. an IAM role that's technically valid but grants too much). Pair with tfsec or OPA for the second pass.
• CrowdSec without scenarios review. Default scenarios block obvious attackers but can false-positive on aggressive crawlers. Tune parsers/scenarios or you'll block your own monitoring.

A typical day with this stack

A representative pipeline using these six tools looks like this. Developer pushes a feature branch. CI runs checkov -d terraform/ and checkov -d k8s/ first — fail-fast on misconfigured manifests before anything builds. Build job produces an OCI image and pushes it to Harbor; a Harbor webhook triggers grype harbor.example.com/team/app:sha-abc123 and stores the JSON report. A nightly job re-runs Grype against the SBOMs in artifact storage so newly disclosed CVEs surface against last week's images automatically.

In production, every node runs the CrowdSec agent. The agent watches access logs, classifies suspicious patterns (credential stuffing, SQL injection probes, scraper bursts), and pushes verdicts to a local API that nginx + Traefik query. Cilium runs as the CNI; NetworkPolicies are versioned in the same repo as application code, and cilium connectivity test is part of every cluster bootstrap. Hubble flows are sampled to a long-term store so post-incident forensics has the data ready.

When this pack alone isn't enough

If you run on Kubernetes at scale, layer in Falco for syscall-level runtime detection (it's the OG runtime tool — Cilium's Tetragon now overlaps but Falco's rule corpus is larger). For secrets specifically, add Vault or Infisical — neither is in this pack because secrets management is a different problem space. For supply-chain provenance (who built this image, on what runner), look at Sigstore + in-toto attestations; Harbor supports cosign signing natively, so the path is short. For compliance reports auditors actually accept, pipe Grype + Checkov JSON into DefectDojo to get a vulnerability management UI on top of the raw findings.