Time to PATCH (again) - Attackers can escape Linux CONTAINERS and obtain unauthorized, root-level access to the host operating system.

• Docker users should check the Docker release notes for version 18.09.2.
• Kubernetes users should consult the Kubernetes blog article entitled Runc and CVE-2019-5736, 
• Any containerization product that uses runc is probably vulnerable – if you have a version numbered runc 1.0-rc6 or earlier, you need to take action

• Patch runc if you’re using it yourself.
• Stop guest containers running as root if you can.
• Ask your provider if they’re using runc on your behalf. 

CVE-2019-5736 - This bug means that a program run with root privileges inside a guest container can make changes with root privilege outside that container.

https://nakedsecurity.sophos.com/2019/02/12/linux-container-bug-could-eat-your-server-from-the-inside-patch-now/

Container Security - If we continue to follow the traditional scanning process then we have a problem - Nearly half of all companies know that they're deploying containers with security flaws, according to a new survey. 60% of those surveyed say that their organization suffered a container security breach in the last year.

"The way to address container security is to build security controls into the DevOps process. If you're looking for vulnerabilities or mis-compliance, you want to find them in the build ahead of deployment, and you want to make sure the process will allow them to be fixed before deploying,"

The solution for the container security problem lies in the development cycle, Erlin says. "The way to address container security is to build security controls into the DevOps process. If you're looking for vulnerabilities or mis-compliance, you want to find them in the build ahead of deployment, and you want to make sure the process will allow them to be fixed before deploying," he explains.

Too many companies are using traditional security scanning processes, in which they scan for vulnerabilities when the application is deployed, and then try to fix issues in a DevOps process — and they're finding that it doesn't work, Erlin says. The problem isn't primarily with the tools they're using.

"I don't think this is a technology challenge as much as an adoption challenge. " Erlin says. Looking ahead, though, he sees promise in the form of new employees being hired to work with containers.

https://www.darkreading.com/vulnerabilities-and-threats/container-deployments-bring-security-woes-at-devops-speed/d/d-id/1333622

If you are serious about securing container apps then, here is a 8-Point Security Checklist.

Organizations need to think about security through the application stack both before deploying a container and throughout its life cycle. "While containers inherit many of the security features of Linux, there are some specific issues that need to be considered when it comes to the model,"

1. Secrets Management
2. Image Provenances
3. Visibility Into Container Workflow
4. Standardized Configuration and Deployment
5. Discovery and Monitoring 
6. Container-Specific Host OS
7. Container Risk-Prioritization
8. Group Containers

https://www.darkreading.com/cloud/containerized-apps-an-8-point-security-checklist/d/d-id/1332045