Harden the containers your code runs in and the Kubernetes clusters that orchestrate them — covering image scanning, access controls, network isolation, policy enforcement, and real-time threat detection.
* Docker architecture — daemon, client, images, containers, and the attack surface of each * Dockerfile best practices — non-root users, minimal base images, no secrets in layers * Multi-stage builds and distroless images — separating build from runtime to shrink attack surface * Trivy — scanning images, filesystems, and Kubernetes manifests for CVEs and misconfigurations * Hadolint — linting Dockerfiles against best practices and security rules * Read-only root filesystems and seccomp profiles — restricting runtime capabilities
* Kubernetes RBAC — Roles, ClusterRoles, RoleBindings, and service account least privilege * Network Policies — default deny all, then explicitly allow what is needed * Pod Security Standards — restricted, baseline, and privileged modes enforced at namespace level * External Secrets Operator — syncing secrets from AWS Secrets Manager and Vault into Kubernetes * Kyverno policies — enforcing security rules at admission time without writing Go code * OPA Gatekeeper — Rego-based policy enforcement for complex multi-condition rules
* Falco architecture — eBPF-based system call monitoring in Kubernetes workloads * Writing Falco rules — detecting shell spawns, privilege escalations, and unexpected network calls * Alert routing — sending Falco findings to Slack, PagerDuty, and SIEM systems * Distinguishing real attacks from false positives — tuning rules for your workload patterns * Kubernetes audit logs — recording every API server call for incident investigation
* Take a deliberately insecure Dockerfile, fix every Hadolint warning, rebuild as distroless, verify it runs as non-root with read-only filesystem * Deploy a Kubernetes cluster with default-deny Network Policies and RBAC bindings — verify namespace isolation and create targeted allow rules * Write a Kyverno policy blocking pods running as root, requiring resource limits and required labels — test against compliant and non-compliant specs * Install Falco, exec into a running pod, observe Falco detect the shell spawn in real time — tune the rule to reduce false positives
Docker architecture — daemon, client, images, containers, and the attack surface of each Dockerfile best practices — non...
Kubernetes RBAC — Roles, ClusterRoles, RoleBindings, and service account least privilege Network Policies — default deny...
Falco architecture — eBPF-based system call monitoring in Kubernetes workloads Writing Falco rules — detecting shell spa...
Take a deliberately insecure Dockerfile, fix every Hadolint warning, rebuild as distroless, verify it runs as non-root w...
Aligns directly with DevOps, Site Reliability (SRE), and Platform Engineering job descriptions.