In September 2024 I delivered a technical webinar for Payatu on Docker and Kubernetes security, aimed at engineers who are already shipping containers and want to understand how that infrastructure actually gets attacked.
The premise
Containers changed how software is deployed far faster than they changed how it is secured. Most teams inherit a cluster, deploy into it, and never look at the defaults — and the defaults are where the interesting findings are.
The session worked outward from a single compromised container: what an attacker can see, what they can reach, and how far a small foothold travels when the surrounding configuration was never reviewed.
Ground covered
- Container fundamentals — images, layers and what actually ends up baked into a published image.
- Docker misconfigurations — privileged containers, mounted sockets, and the difference they make to an attacker.
- Kubernetes architecture — the control plane, the components worth understanding before you try to secure them.
- RBAC and service accounts — where over-permissive roles quietly accumulate.
- Secrets handling — how credentials end up readable from inside a pod.
- Lateral movement — from one workload to the rest of the cluster.
The takeaway
Very little of container security is exotic. It is defaults nobody revisited, permissions granted once to unblock a deploy, and secrets handled as though the cluster boundary were a security boundary.
The useful mental shift is to stop treating a container as an isolation boundary and start asking what an attacker reaches the moment they are inside one.
This is a summary of the session rather than a transcript. If you want the slides or a walkthrough of any section, get in touch.