Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. I'm not asking about vulnerability scanning—I'm specifically interested in detecting malicious files or malware in container images, both before deployment and while containers are running. Do you use a dedicated tool, such as a runtime container security platform, or rely on host monitoring and process behavior analysis?
2 Answers
I use Malcontent in the CI/CD pipeline to scan container images and perform differential analysis before they are promoted. That gives us a way to check image contents and identify unexpected changes early.
A malware scan after deployment is usually too late—it mainly confirms that an unsafe image was promoted. Scan images before they enter the registry, then use runtime security for threats that image scanning cannot detect, such as a clean container downloading or executing something unexpected.
I’m not sure a standard image vulnerability scan would detect hidden malware. For runtime monitoring, what would you use to inspect container files and processes? The processes may be visible to the host, but the container filesystems are isolated, so traditional endpoint antivirus may not be able to scan them directly.
Thanks, that’s helpful. I’ll take a closer look at using it in the build pipeline.