Image scanning tells you what vulnerabilities are packaged into a container before it runs. Runtime security is a distinct, complementary layer — what's actually happening while that container is executing in production.
Why runtime matters beyond image scanning
A perfectly scanned, vulnerability-free image can still be compromised at runtime through an application-level vulnerability (like remote code execution in the running application itself), unrelated to anything a pre-deployment image scan would catch. Runtime security monitors actual behavior — unexpected process execution, unusual network connections, file system changes — to catch this class of compromise.
Common container escape vectors
- Running as root inside the container, combined with a container runtime or kernel vulnerability, can lead to host-level compromise.
- Overly permissive capabilities (like
SYS_ADMIN) granted to a container beyond what it actually needs. - Mounted host paths or Docker socket access, which can provide a direct path to the underlying host or full control over the container runtime itself.
- Privileged mode, which effectively disables most container isolation — reserve it only for cases with no viable alternative.
Runtime hardening steps
- Run as non-root wherever the application supports it — a straightforward, low-cost reduction in escape severity.
- Drop unnecessary Linux capabilities, granting only what the specific workload genuinely needs rather than the runtime default set.
- Avoid privileged mode and host mounts unless there's a specific, well-understood reason, and scope any such exception tightly.
- Use read-only root filesystems where the application allows it, limiting what a compromised process can actually modify.
Runtime detection tools
Tools like Falco monitor container and host behavior against defined rules, alerting on anomalous activity — like a shell being spawned inside a container that shouldn't normally spawn one, or an unexpected outbound connection. This provides detection for compromise that occurs after deployment, which static scanning inherently can't catch.
Combining both layers
Image scanning and runtime security answer different questions — "what known issues does this image contain" versus "what is this running container actually doing." A mature container security posture needs both, since neither alone covers the full lifecycle from build through live execution.