* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * What is container security? What is container security? =========================== Published April 13, 2023•*8*-minute read Copy URL Jump to section --------------- OverviewSupply chain securitySecurity in the container pipelineManage accessSecurity testing and deployment automationContainerized workloads at runtimeDefend your infrastructureHow Red Hat can help What is container security? --------------------------- Container security is the process of safeguarding containerized applications from malware and other vulnerabilities. It involves defining and adhering to build, deployment, and runtime practices that protect your [Linux container](/en/topics/containers/whats-a-linux-container)―from the applications it supports to the infrastructure it relies on. As organizations adopt microservice design patterns and container technologies—such as Docker and Kubernetes—security teams are challenged to develop container security solutions that facilitate these infrastructure shifts. Container security needs to be integrated and continuous and support an enterprise’s overall security posture. The container orchestrator (namely Kubernetes) plays a critical role in container security, and offers access to rich contextual data for better visibility and compliance, context-based risk profiling, networking, and runtime detection. Effective container security builds on Kubernetes constructs, such as deployments, pods, network policies, and so on. Kubernetes network policies, for example, is a built-in security feature that should be used to control pod-to-pod communication and minimize an attacker’s blast radius. In general, continuous container security for the enterprise is about: * Securing the container pipeline and the application * Securing the container deployment environment(s) and infrastructure * Securing the containerized workloads at runtime Find out how companies are implementing container security initiatives. [Get the State of Kubernetes Security Report](/en/resources/state-kubernetes-security-report) Container security is software supply chain security ---------------------------------------------------- In traditional software development, a security review can be a final series of tests at the end of development. But with modern cloud-native development workflows, the attack surface is much greater, and security becomes a more complex problem. In cloud-native environments, where [containers](/en/topics/containers) are the standard application delivery format, code is updated frequently and ingested from multiple repositories. Human error, such as misconfigurations, can open the door to unauthorized access at many points in the development and deployment cycle. Security vulnerabilities can emerge from practically anywhere. For this reason, security must be a continuous process. Just as container deployment is handled with automation (using container orchestration tools like Kubernetes), security has to be automated as well. Using [DevSecOps](/en/topics/devops/what-is-devsecops) principles (a concept created to add a security emphasis to [DevOps](/en/topics/devops)), code can be vetted and checked continuously throughout the development cycle. Vulnerabilities can be discovered and remediated early and quickly, rather than being overlooked until they emerge as time-consuming surprises. Because containers are immutable, container security means patching code at the build stage, not while running, so vulnerabilities don’t reemerge when containers are destroyed and rebuilt. Scanning container images for malware and other security vulnerabilities is a critical step—and should be one of several layers of security. Organizations need to give consideration to the security of the entire software supply chain—in other words, all of the steps in the development and deployment of containerized software, including dependencies and runtime environments. Here are a few specific strategies for containerized development that take [supply chain security](/en/topics/security/what-is-software-supply-chain-security) into account: * Trusted content and an enterprise-grade content repository deliver pre-hardened images with advanced security and access controls. * A Zero Trust approach assigns the lowest access levels possible to critical resources. * Policy as Code embeds security controls directly in the [CI/CD](/en/topics/devops/what-is-ci-cd) pipeline. * Signing and verifications enforces attestation and establishes trust by verifying that container images haven’t been tampered with. * GitOps practices help manage application and container security configurations. [Learn more about Red Hat® Trusted Software Supply Chain](/en/solutions/trusted-software-supply-chain "Learn more about Red Hat® Trusted Software Supply Chain") Zero trust workload identity manager ------------------------------------ [Keep reading](/en/technologies/cloud-computing/openshift/zero-trust-workload-identity-manager "Keep reading") Basic steps for build security into the container pipeline ---------------------------------------------------------- ### Gather images [Containers](/en/topics/containers) are created out of layers of files called container images. A tool like Buildah lets you build OCI- and Docker-compatible images from scratch, with or without an existing container image starting point. Container images are the standard application delivery format in cloud-native environments, but even cloud-native companies mix workloads between cloud providers. The ideal container security solution should support all architectures—whether your infrastructure runs on private hardware, a shared data center, or a public cloud like Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform. The base image, or golden image, is one of the most important for security purposes, because it is used as the starting point from which you create derivative images. Container security starts with finding trusted sources for base images. Confirm that the image comes from a known company or open source group, is hosted on a reputable registry, and that the source code for all components in the image are available. Even when using trusted images, though, adding applications and making configuration changes will introduce new variables. When bringing in external content to build your apps, keep proactive vulnerability management in mind: * Use an image scanner, either built into the registry or separate, to scan all images on a regular cadence. Look for a scanner that scans based on specific languages, packages, and image layers. * Identify modified container images that break policies or documented best practices—known as container misconfigurations—to reduce the likelihood and impact of potential compromises. [Read a blog post about container image security](https://cloud.redhat.com/blog/container-image-security-beyond-vulnerability-scanning) ### Anticipate and remediate vulnerabilities Containers are popular because they make it easy to build, package, and promote an application or service, and all its dependencies, throughout its entire [lifecycle](/en/topics/devops/what-is-application-lifecycle-management-alm) and across different workflows and deployment targets. But there are still some challenges to container security. Containers can help you implement finer-grained workload-level security, but they also introduce new [infrastructure](/en/topics/cloud-computing/what-is-it-infrastructure) components and unfamiliar attack surfaces. The right container security solution must help secure the cluster infrastructure and [orchestrator](/en/topics/containers/what-is-container-orchestration) as well as the [containerized](/en/topics/cloud-native-apps/what-is-containerization) applications they run. Static security policies and checklists don’t scale for containers in the enterprise: * The supply chain needs more security policy services. * Security teams need to balance the networking and governance needs of a containerized environment. * Tools used during the build, maintenance, and service stages need to have different permission policies. An effective container security program seeks to remediate vulnerabilities in real-time and reduce the attack surface before images are deployed while retaining provenance details. By building security into the container pipeline and defending your infrastructure, you can make sure your containers are reliable, scalable, and trusted. When gathering container images, ask: * Are the container images signed and from trusted sources? * Where did the image come from, and how can I rebuild it? * When was the last scan date for a given image? * Are the runtime and operating system layers up to date? * How quickly and how often will the container be updated? * Are security risks identified, and how will they be tracked? Manage access ------------- Once you’ve obtained your images, the next step is to manage both access to, and promotion of, all container images your team uses. That means protecting the images you download as well as the ones you build. Using a private registry will allow you to control access through role-based assignments while also helping you manage content by assigning relevant metadata to the container. This metadata will help you identify and track known vulnerabilities. A private [container registry](/en/topics/cloud-native-apps/what-is-a-container-registry) also gives you the power to [automate](/en/topics/automation) and assign policies for the images you have stored, minimizing human errors that may introduce vulnerabilities into your container environment. Container registries with enterprise-grade security capabilities will also have built-in vulnerability scanners. When deciding how to manage access, ask: * What [role-based access controls](/en/topics/containers/what-kubernetes-role-based-access-control-rbac) can you use to manage container images? * Are there tagging abilities, to help sort images? Can you tag images as approved only for development, and then testing, and then production environments? * Does the registry offer visible metadata that allows you to track known vulnerabilities? * Can you use the registry to assign and automate policy (e.g. checking signatures, application code scans, etc.)? [E-book: Boost your hybrid cloud security](/en/resources/hybrid-cloud-security-ebook) Integrate security testing and automate deployment -------------------------------------------------- The last step of the pipeline is [deployment](/en/topics/containers/what-is-kubernetes-deployment). Once you’ve completed your builds, you need to manage them according to industry standards, such as those established by the Center for Internet Security (CIS) and the National Institute of Standards and Technology (NIST). The trick here is to understand how to [automate](/en/topics/automation/what-is-deployment-automation) policies to flag builds with security issues, especially as new vulnerabilities are found. While vulnerability scanning remains important, it is only part of a larger set of security initiatives used to protect your container environments. Because [patching](/en/topics/management/what-patch-management-and-automation) containers is never as good of a solution as rebuilding them, [integrating](/en/topics/integration/what-is-integration) security testing should take into account policies that trigger automated rebuilds. Running on component analysis tools that can track and flag issues is the first part of this step. The second part is establishing tooling for automated, policy-based deployment. When integrating security testing and automated deployment, ask: * Do any of my containers contain known vulnerabilities that I should fix before they're deployed into a production environment? * Are my deployments configured correctly? Are there overly privileged containers that don’t need the heightened privilege? Am I using a read-only root file system? * What’s my compliance posture with CIS Benchmarks and [NIST SP 800-190](/en/resources/guide-nist-compliance-container-environments-detail)? * Am I isolating any workloads deemed sensitive using built-in features such as network policies and namespaces? * Am I using built-in security and hardening features such as SELinux, AppArmor, and seccomp profiles? Secure containerized workloads at runtime ----------------------------------------- Container security continues after testing and deployment, and extends to when the containerized applications are running. Aspects like threat detection, network security, and incident response become more relevant. At runtime, applications can face unpredictable real-life threats where vulnerabilities and misconfigurations missed during the build time can be exploited. Runtime security should include looking for applications behaving in unexpected ways. Anomaly detection at runtime can identify privilege escalations, cryptomining, unexpected network flows, container escape, and other insecure behaviors. Network segmentation is another concern for minimizing your attack surface. In Kubernetes, default network policies allow pods to communicate with other pods within a cluster. When you enforce zero trust policies, you can make sure a single compromised pod won’t lead to a compromise of all pods within that cluster. Finally, incident response strategies can help teams respond appropriately to events. Responses can include sending events to a Security Information and Event Management (SIEM) system, alerting the application owner with detailed information and steps on which deployment needs remediation, and even killing and restarting pods automatically. Responses should follow the practice of rebuilding and redeploying problem containers, rather than patching running containers. [Whitepaper: Learn about a layered approach to container and Kubernetes security](/en/resources/layered-approach-container-kubernetes-security-whitepaper) Defend your infrastructure -------------------------- Another layer of container security is the isolation provided by the container’s node/host operating system (OS). You need a host OS that provides maximum container isolation. This is a big part of what it means to defend your container deployments environment. The host OS in a containerized, Kubernetes environment is shared among containers, and is managed by a container runtime, which interacts with Kubernetes to create and manage containers (or pods of containers). The host OS should be isolated from the container, in order to prevent a single compromised container from compromising the host OS and all the other containers. To make your container platform resilient, use network namespaces to sequester applications and environments, and attach storage via secure mounts. Don't configure your container runtime to share host network namespace, IPC namespace, or UPC namespace. Choose a container-optimized host operating system that's prehardened, and use host vulnerability scanning. An [API management](/en/topics/api/what-is-api-management) solution should include authentication and authorization, [LDAP](/en/topics/security/what-is-ldap-authentication) integration, end-point access controls, and rate limiting. When deciding how to defend your container infrastructure, ask: * Which containers need to access one another? How will they discover each other? * How will you control access and management of shared resources (e.g. network and storage)? * How will you monitor container health? * How will you automatically scale application capacity to meet demand? * How will you manage host updates? Will all of your containers require updates at the same time? We can help ----------- [Red Hat® OpenShift®](/en/technologies/cloud-computing/openshift) includes [Red Hat Enterprise Linux®](/en/technologies/linux-platforms/enterprise-linux). It automates the container application life cycle, integrates security into the container pipeline, and enables your transition from DevOps to a DevSecOps strategy. Our [container catalog](https://access.redhat.com/containers/) provides you with access to a large number of certified images, language runtimes, databases, and middleware that can run anywhere you run Red Hat Enterprise Linux. Images from Red Hat are always signed and verified to ensure origin and integrity. We monitor our container images for newly discovered vulnerabilities (which includes a continually updated and publicly visible health index), as well as release security updates and container rebuilds that are pushed to our public registry. [Red Hat Advanced Cluster Security for Kubernetes](/en/technologies/management/advanced-cluster-management) integrates with DevOps and security tools to help mitigate threats and enforce security policies that minimize operational risk to your applications. [Red Hat Service Interconnect](/en/technologies/cloud-computing/service-interconnect) allows containers to access and communicate with one another while minimizing the added risk to your organization’s security or the user’s data. Red Hat’s security partners can extend and enhance our container security capabilities with certified integrations. Red Hat OpenShift has security built into the platform, which complements our security partner solutions, to help secure applications and containers throughout the DevOps life cycle. Plus, all of this other stuff is pretty good, too: * Web-scale container orchestration and management * Rich web console with multi-user collaboration features * CLI & IDE interfaces * Integration with CI * Build automation & source-to-image * Deployment automation * Support for remote storage volumes * Simplified installation & administration * A large collection of supported programming languages, frameworks, & services [Enhance security with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/security) Resource Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management -------------------------------------------------------------------------------- Read the 2025 Gartner® Magic Quadrant™ for Container Management to learn why Red Hat OpenShift has been named a “Leader” for the 3rd year in a row. [Read the report](/en/engage/gartner-magic-quadrant-container-management-analyst-report "Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is security automation? Security automation uses technology to perform tasks with reduced human assistance to integrate security processes, applications, and infrastructure. [Read the article](/en/topics/automation/what-is-security-automation "article | what is security automation") ### What is SOAR? SOAR refers to 3 key software capabilities that security teams use: case and workflow management, task automation, and a centralized means of accessing, querying, and sharing threat intelligence. [Read the article](/en/topics/security/what-is-soar "article | what is soar") ### What's an insider threat? An insider threat is leaked or misused data that—whether released accidentally or purposefully—could be used in malicious ways or viewed by individuals who shouldn’t have legitimate access. [Read the article](/en/topics/security/what-are-insider-threats "article | What's an insider threat") Security resources ------------------ ### Related content * Blog post [Announcing Red Hat Advanced Cluster Security for Kubernetes 4.10](/en/blog/announcing-red-hat-advanced-cluster-security-kubernetes-410) * Blog post [4 use cases for AI in cyber security](/en/blog/4-use-cases-ai-cyber-security) * Blog post [AI security: Identity and access control](/en/blog/ai-security-identity-and-access-control) * Blog post [AI security: Defending against prompt injection and unsafe actions](/en/blog/ai-security-defending-against-prompt-injection-and-unsafe-actions) ### Related articles * [What is patch management?](/en/topics/management/what-patch-management-and-automation) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers) * [What is a Linux container?](/en/topics/containers/whats-a-linux-container) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is SOAR?](/en/topics/security/what-is-soar) * [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [What is CaaS?](/en/topics/cloud-computing/what-is-caas) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop) * [What is Podman?](/en/topics/containers/what-is-podman) * [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms) * [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing) * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [What is container orchestration?](/en/topics/containers/what-is-container-orchestration) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless) * [What is access control?](/en/topics/security/what-is-access-control) * [What is Kubernetes?](/en/topics/containers/what-is-kubernetes) * [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware) * [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is a CVE?](/en/topics/security/what-is-cve) * [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What are microservices?](/en/topics/microservices/what-are-microservices) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [What is Buildah?](/en/topics/containers/what-is-buildah) * [What are sandboxed containers](/en/topics/containers/sandboxed-containers) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws) * [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd) * [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes) * [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers) * [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes) * [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [What is a golden image?](/en/topics/linux/what-is-a-golden-image) * [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services) * [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference) * [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry) * [What is Skopeo?](/en/topics/containers/what-is-skopeo) * [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators) * [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift) * [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [What is KubeLinter?](/en/topics/containers/what-is-kubelinter) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare) * [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management) * [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure) * [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders) * [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift) * [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management) * [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap) * [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus) * [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes) * [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations) * [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac) * [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial) * [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture) * [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment) * [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus) * [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture) * [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns) * [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster) * [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus) * [What is Jaeger?](/en/topics/microservices/what-is-jaeger) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is etcd?](/en/topics/containers/what-is-etcd) * [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization) * [What is Clair?](/en/topics/containers/what-is-clair) * [What is Knative?](/en/topics/microservices/what-is-knative) * [What is API security?](/en/topics/security/api-security) * [What is malware?](/en/topics/security/what-is-malware) * [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices) * [What is cloud security](/en/topics/security/cloud-security) * [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers) * [What is Docker?](/en/topics/containers/what-is-docker) * [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod) [More about this topic](/en/topics/security "More about this topic")