Containers are units of software that allows you to deploy applications as stand-alone, self-sufficient packages isolated from other activity on a machine. Containers are similar to virtual machines (VMs), but do not run an entire operating system. Instead, they share access to the operating system (OS) kernel, which makes them faster and more lightweight than VMs.
Container security requires a different approach compared to security in traditional environments. Containers need a continuous security strategy integrated into the entire software development lifecycle (SDLC). This means securing the build pipeline, container images, container host machines, container runtimes (such as Docker or containerd), container platforms and orchestrators (such as Kubernetes), and application layers.
Due to the complexity and dynamic nature of a containerized environment, container security must be fully automated. An important step to automating security and embedding it into all stages of the SDLC is to implement security controls as part of the continuous delivery lifecycle used to build and release containerized applications.