* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* Container and Kubernetes compliance considerations
Container and Kubernetes compliance considerations
==================================================
Published  September 15, 2021•*8*-minute read
Copy URL
Jump to section
---------------
OverviewCompliance considerationsNIST SP 800-190PCI compliance in container and Kubernetes environmentsHIPAA compliance in container and Kubernetes environments
Overview
--------
If you’re running [containers](/en/topics/containers/whats-a-linux-container) you have thought about potential security risks. You may be just adopting a [DevOps](/en/topics/automation/what-is-devops-automation) approach to your workflows or you may have a well-established [CI/CD pipeline](/en/topics/devops/what-cicd-pipeline) but you want to protect your sensitive [data](/en/topics/big-data).
Role-Based Access Control (RBAC) provides the standard method for managing authorization for the [Kubernetes API](/en/topics/containers/what-is-the-kubernetes-api) endpoints. Your [Kubernetes](/en/topics/containers/what-is-kubernetes) cluster’s RBAC configuration controls which subjects can execute which verbs on which resource types in which namespaces, but RBAC doesn’t prescribe how you should configure your roles. That’s where compliance frameworks come in.
[Read an intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security "Intro to Kubernetes security")
Compliance considerations
-------------------------
For many industries, meeting compliance requirements is a necessary part of doing business. While initially compliance concerns could be a hurdle to building and running [containerized](/en/topics/containers/whats-a-linux-container), [cloud-native](/en/topics/cloud-native-apps) applications, frameworks and technologies are evolving rapidly to enable comprehensive compliance in a cloud-native environment. The major compliance frameworks relevant to containerized applications are:
* CIS Benchmarks for Kubernetes and Docker
* NIST SP 800-190
* PCI
* HIPAA
Compliance is ultimately about ensuring that your applications are secure. Because they also require that organizations be able to prove to a third party that the applications are continually secure, however, meeting compliance requirements can be more challenging than simply securing the application. It also involves tracking and keeping records that prove continual compliance.
Compliance can be challenging, but failing to meet compliance standards can be even more expensive—the average cost of fines related to compliance violations is nearly three times the average cost of meeting compliance requirements.
Compliance standards can also be an important part of how organizations set security governance policies. Instead of creating guidelines from scratch, organizations, even those who are not required to meet a specific framework’s guidelines, can use compliance frameworks as a starting point for setting their own internal policies.
**The frameworks**
**CIS Benchmarks**: Developed by the Center for Internet Security, the CIS Benchmarks provide best practices for containers, specifically those using the Docker runtime, and Kubernetes, but they are not binding for any industry.
**NIST 800-190**: The National Institute of Standards and Technology framework for [container security](/en/topics/security/container-security) is one of many cybersecurity compliance frameworks published by the National Institute of Standards and Technology. All U.S. federal government agencies and government contractors have to meet NIST 800-190 requirements.
**PCI**: Developed by a partnership by five major credit card companies, the Payment Card Industry (PCI) framework covers organizations that store, process, or transmit payment information.
**HIPAA**: The technological safeguards to the HIPAA act address how organizations that collect, process, or transmit individually identifiable electronic protected health information.
Red Hat resources
-----------------
[Keep reading](/en/resources "Keep reading")
NIST SP 800-190
---------------
The National Institute of Standards and Technology Special Publication 800-190 (NIST 800-190) offers a framework for understanding some of the specific challenges related to securing containerized applications, as well as what organizations need to do to improve the application’s security profile.
NIST guidelines are targeted toward U.S. government agencies, as well as government contractors, but any company might want to follow NIST 800-190 guidelines, both to improve overall security and because they can make it easier to meet other compliance frameworks like PCI and HIPAA.
**The risks**
The NIST 800-190 highlights common sources of security vulnerabilities in containerized applications, which include:
* Compromised images
* Misconfigurations in container images
* Untrusted container images
* Poorly managed secrets
* Misconfigured access controls
* OS vulnerabilities
* Unnecessarily large attack surfaces
Just as importantly, the NIST 800-190 stresses the need for organizations to approach security for containerized applications in a different way than they did for traditional applications. Containerized applications have different risk factors than virtual machines and require a different set of security practices.
NIST 800-190 requires organizations to:
* Use purpose-built tools to manage image vulnerabilities throughout the entire image lifecycle, from build through deploy and runtime.
* Ensure that images comply with configuration best practices.
* Protect secrets by storing them outside the image, using Kubernetes to manage secrets, restrict access to secrets to those containers that need them and encrypt secrets at rest and in transit.
* Use a secure connection when pushing or pulling from the registry.
* Ensure that the container always uses the latest image version.
* Segment network traffic, at the very least to isolate sensitive from non-sensitive networks.
* Use Kubernetes to securely introduce nodes and keep an inventory of nodes and their connectivity states.
* Control outbound traffic from containers.
* Ensure continual compliance with container runtime configurations standards such as the CIS benchmarks.
* Use security controls to detect threats and potential intrusions at the container and infrastructure level.
* Use a hardened, container-specific operating system with an attack surface that is as small as possible.
* Prevent host file system tampering by ensuring containers have as few permissions as possible to function as designed.
Even organizations who don’t need to comply with the NIST 800-190 requirements should consider them a useful framework for improving the organization’s security posture. They ensure organizations are thinking about security throughout the build, deploy and runtime phases, addressing the unique security requirements of each stage.
PCI compliance in container and Kubernetes environments
-------------------------------------------------------
The Payment Card Industry Data Security Standard (PCI DSS) was created in 2004 by Visa, MasterCard, American Express, Discover, and JCP to create an industry-wide standard for security and data protection. The standards have been updated many times since they were first released to keep up with changes in technology. The standards apply to everything in the cardholder data environment, which is the people, processes, and technologies that store, process, or transmit cardholder data. In terms of technology, this includes both hardware and software.
Complying with PCI requirements isn’t easy, and costs an average of $5.5 million annually for companies. However, non-compliance is much more expensive, with an average annual cost from penalties of $14.8 million. With the right processes and tools in place, PCI compliance doesn’t have to be a major challenge.
PCI DSS has 12 requirements that are mapped to 6 more general goals. They are:
**Build and maintain a secure network system**
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
**Protect cardholder data**
1. Protect stored cardholder data
2. Encrypt transmission of cardholder data across open, public networks
**Ensure the maintenance of vulnerability management programs**
1. Protect all systems against malware and exploits, and regularly update anti-virus software
2. Develop and maintain secure systems and applications
3. Implement strong access control measure
**Restrict access to cardholder data by business based on need-to-know**
1. Identify and authenticate access to system components
2. Restrict physical access to cardholder data
**Regularly monitor and test networks**
1. Track and monitor all access to network resources and cardholder data
2. Regularly test security systems and processes
**Ensure the maintenance of information security policies**
1. Maintain a policy that addresses information security for all personnel
### PCI compliance for containerized applications
There are several requirements pertaining to each of the above six goals outlined by PCI that are directly relevant to container and Kubernetes environments. Evaluate your container and [Kubernetes security](/en/topics/containers/kubernetes-security) tooling to ensure they can address these requirements:
1.12 Current network diagram that identifies all connections between the cardholder data environment (CDE) and other networks, including any wireless networks
1.1.4 Requirements for a firewall at each internet connection and between any demilitarized zone (DMZ) and the internal network zone.
1.2 Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.
1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment and specifically deny all other traffic.
1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.
1.3.4 Do not allow unauthorized outbound traffic from the cardholder data environment to the internet.
1.3.5 Permit only "established" connections into the network.
2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network.
2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry- accepted system hardening standards.
2.2.1 Implement only one primary function per server to prevent functions that require different security levels from coexisting on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)
2.2.2 Enable only necessary services, protocols, daemons, etc., as required for the function of the system.
2.2.3 Implement additional security features for any required services, protocols, or daemons that are considered to be insecure.
2.2.5 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.
2.3 Encrypt all non-console administrative access using strong cryptography.
2.4 Maintain an inventory of system components that are in scope for PCI DSS.
3.6.2 Secure cryptographic key distribution.
6.1 Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information, and assign a risk ranking (for example, as "high," "medium," or "low") to newly discovered security vulnerabilities.
6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.
6.4.1 Separate development/test environments from production environments and enforce the separation with access tools.
6.4.2 Separation of duties between development/test and production environments.
6.5.1 Injection flaws, particularly SQL injection. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.
6.5.3 Insecure cryptographic storage.
6.5.4 Insecure communications.
6.5.6 All "high risk" vulnerabilities identified in the vulnerability identification process (as defined in PCI DSS Requirement 6.1).
10.2.5 Implement automated audit trails for all system components to reconstruct use of and changes to identification and authentication mechanisms—including but not limited to creation of new accounts and elevation of privileges—and all changes, additions, or deletions to accounts with root or administrative privileges.
11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify that all "high risk" vulnerabilities are resolved in accordance with the entity’s vulnerability ranking (per Requirement 6.1). Scans must be performed by qualified personnel.
11.5 Deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly.
11.5.1 Implement a process to respond to any alerts generated by the change-detection solution.
HIPAA compliance in container and Kubernetes environments
---------------------------------------------------------
The Health Information Portability and Accountability Act of 1996 created the HIPAA compliance framework to govern patient privacy related to any and all health records. The Security Rule, added in 2003, governs digital health records. Any organization that handles electronic protected health information ( ePHI) that is individually identifiable has to comply with HIPAA requirements. This includes applications used directly by healthcare providers for care, communications, or billing.
The primary challenge for HIPAA compliance is that the security framework provides only high-level guidance rather than specifics on how organizations should meet those guidelines in containers and Kubernetes. In addition, the difference between what is and what is not protected health information is often less obvious than, for example, what is and is not credit card information that must be protected under PCI compliance.
In addition to healthcare providers themselves, any organizations that provide services like storage or billing to healthcare providers have to meet HIPAA requirements if the services they provide involve handling electronic personal health information (ePHI).
The HIPAA Security Rule standards are broken into administrative, physical, and technical safeguards. The technical safeguards, which relate to the IT infrastructure, include the following standards:
* Access control
* Audit controls
* Integrity
* Authentication
* Transmission security
The HIPAA Security Rule doesn’t provide specifics on how organizations should secure ePHI, and is not specific to containerized applications. Often, the best place to start working towards HIPAA compliance is by applying the NIST SP 800-190 framework, which provides guidelines and best practices for container security. Unlike HIPAA, NIST SP 800-190 provides a framework that is specific to containers and can therefore be easier to demonstrate compliance. However, meeting HIPAA requirements involves implementing additional data segregation controls to protect ePHI and keep it separate from other types of data.
HIPAA also requires that organizations keep backups of not just data but also configuration files, so that the application can be fully recovered to demonstrate continual compliance.
The official Red Hat blog
-------------------------
Get the latest information about our ecosystem of customers, partners, and communities.
[Keep reading](/en/blog "The official Red Hat blog")
Recommended for you
Multicluster Management with Red Hat Advanced Cluster Management for Kubernetes
-------------------------------------------------------------------------------
Address challenges with management, compliance, and productivity of a multicluster Kubernetes environment and its applications by using the capabilities of Red Hat Advanced Cluster Management for Kubernetes.
[View course](https://www.redhat.com/en/services/training/do432-multicluster-management-red-hat-advanced-cluster-management-kubernetes?percmp=RHCTG0250000455236)
Keep reading
------------
### What is confidential computing?
Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it.
[Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?")
### What are SPIFFE and SPIRE?
SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems.
[Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?")
### Red Hat Enterprise Linux security
Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy.
[Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security")
Security resources
------------------
### Related content
* E-book
  [The state of cloud-native security](/en/resources/state-of-cloud-native-security-ebook)
* Detail
  [CVE management on Red Hat Advanced Cluster Security](/en/resources/cve-management-advanced-cluster-security-detail)
* Case study
  [RTLZWEI hones competitive edge with Red Hat OpenShift AI](/en/resources/rtlzwei-case-study)
* Blog post
  [Ford's keyless strategy for managing 200+ Red Hat OpenShift clusters](/en/blog/fords-keyless-strategy-managing-200-red-hat-openshift-clusters)
### Related articles
* [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms)
* [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing)
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is a Linux container?](/en/topics/containers/whats-a-linux-container)
* [What is container orchestration?](/en/topics/containers/what-is-container-orchestration)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What is Kubernetes?](/en/topics/containers/what-is-kubernetes)
* [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware)
* [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt)
* [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop)
* [What is Podman?](/en/topics/containers/what-is-podman)
* [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client)
* [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What are microservices?](/en/topics/microservices/what-are-microservices)
* [What is container security?](/en/topics/security/container-security)
* [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack)
* [What are sandboxed containers](/en/topics/containers/sandboxed-containers)
* [What is Buildah?](/en/topics/containers/what-is-buildah)
* [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws)
* [What is an image builder?](/en/topics/linux/what-is-an-image-builder)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd)
* [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes)
* [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring)
* [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes)
* [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [What is a golden image?](/en/topics/linux/what-is-a-golden-image)
* [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services)
* [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference)
* [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry)
* [What is Skopeo?](/en/topics/containers/what-is-skopeo)
* [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators)
* [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security)
* [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [What is KubeLinter?](/en/topics/containers/what-is-kubelinter)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare)
* [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management)
* [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure)
* [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders)
* [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift)
* [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management)
* [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes)
* [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations)
* [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes)
* [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap)
* [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus)
* [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac)
* [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization)
* [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos)
* [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial)
* [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture)
* [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api)
* [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management)
* [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment)
* [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus)
* [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture)
* [What is CaaS?](/en/topics/cloud-computing/what-is-caas)
* [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns)
* [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster)
* [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus)
* [What is Jaeger?](/en/topics/microservices/what-is-jaeger)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is Clair?](/en/topics/containers/what-is-clair)
* [What is Knative?](/en/topics/microservices/what-is-knative)
* [What is API security?](/en/topics/security/api-security)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is etcd?](/en/topics/containers/what-is-etcd)
* [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization)
* [What is malware?](/en/topics/security/what-is-malware)
* [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices)
* [What is cloud security](/en/topics/security/cloud-security)
* [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers)
* [What is Docker?](/en/topics/containers/what-is-docker)
* [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod)
[More about this topic](/en/topics/security "More about this topic")