Container & Kubernetes Penetration Testing

Security assessment of container images and orchestration. Mapped to MITRE ATT&CK (Containers) and CIS Docker/Kubernetes benchmarks.

0. Authorization gate

• Written scope: clusters/namespaces, registries, allowed intensity.
• Prod vs non-prod boundaries; no disruption to running workloads unless cleared.

1. Images & registry

• Scan images for known-vuln packages, embedded secrets, and excessive contents.
• Registry exposure/auth: anonymous pull/push, unsigned images.
• Fix: minimal/base images, image scanning in CI, signing + admission control, no secrets in layers.

2. Container configuration

• Dangerous settings: --privileged, host PID/network/IPC, host path mounts (esp. docker socket), added Linux capabilities, running as root.
• Fix: drop capabilities, non-root, read-only FS, no host mounts, seccomp/AppArmor, Pod Security Standards.

3. Container escape (in scope)

• Assess escape feasibility from misconfig (privileged/host-mount/socket) or kernel vulns → host compromise.
• Fix: the config hardening above; keep host/kernel patched; isolate workloads.

4. Kubernetes control plane

• API server exposure and anonymous/weak auth.
• RBAC review: over-permissive roles/bindings, wildcard verbs/resources, cluster-admin sprawl, service-account token abuse.
• etcd exposure (holds all secrets).
• Kubelet exposure (can allow command exec in pods).
• Fix: authn/authz on all components, least-privilege RBAC, restrict SA token automount, secure etcd, lock down kubelet.

5. Pod → cluster privilege escalation

• Mounted service-account tokens → API access; escalate via permissive RBAC; reach cloud metadata from pods (→ cloud-pentest).
• Fix: disable unnecessary token automount, least-privilege SAs, restrict metadata access from pods, network policies.

6. Secrets & network

• Kubernetes Secrets handling (base64 ≠ encryption; encryption-at-rest, external secret managers).
• Network policy gaps → unrestricted pod-to-pod / east-west movement.
• Fix: encrypt secrets at rest, external secret store, default-deny network policies.

7. Tooling

trivy/grype (images), kube-hunter/kube-bench (posture/CIS), kubectl + can-i (RBAC), peirates (escalation), amicontained (escape checks). Follow RoE.

8. Reporting

Present escape/escalation paths (container → node → cluster → cloud), blast radius, and hardening fixes. Checklist: references/container-checklist.md.

<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>