What it covers. NIST guidance on security concerns of application containers and practical countermeasures. It covers risks to images, registries, orchestrators, containers and host operating systems, and how to adapt security practices to container-based delivery. Its recommendations apply whether containers run on self-managed hosts or on managed cloud platforms.
In practice. Applying it well means scanning images for vulnerabilities and configuration problems, using trusted and signed images from controlled registries, and running containers with least privilege on hardened, container-specific hosts. Orchestrator access is tightly controlled and network policies separate workloads. Evidence includes pipeline scanning results, registry controls, orchestrator configuration and runtime monitoring.
Common gaps. Typical gaps are containers running as root, outdated base images, broad orchestrator permissions and no runtime visibility. Images pulled directly from public registries without review are another frequent weakness.