Question

A DevSecOps team is hardening its Kubernetes workloads. During a security review, an analyst finds that production containers run as root, mount the host Docker socket for logging sidecars, and allow shell access via kubectl exec for troubleshooting. The team wants to reduce the container attack surface while keeping the ability to investigate incidents. Which combination of controls BEST hardens these containers without eliminating incident investigation capability?

Accepted Answer

Run containers as a non-root user with a read-only root filesystem and drop all Linux capabilities, remove the host Docker socket mount, and use an ephemeral debug container for troubleshooting

Answer

Enforce image signing on all pushes and require multi-factor authentication for the container registry while leaving runtime privileges unchanged

Answer

Add a privileged security context to every pod so sidecars can access host resources, and restrict kubectl exec to cluster administrators only

Answer

Deploy a network policy that blocks all egress from production namespaces and scan images for vulnerabilities during the build stage