## Container Security Fundamentals

"But it works on my machine!" - The Developer.

### What is a Container?
A container (Docker) is a lightweight package of software that includes everything needed to run it: code, runtime, system tools, libraries.
*   **Advantage**: Portability. It runs the same on a laptop as in the cloud.
*   **Difference from VM**: It shares the **Host Kernel**. A VM has its own Kernel.
    *   *Security Implication*: If you escape a VM, you hit the Hypervisor. If you escape a Container, you are on the Host Linux OS root.

### The Attack Surface
1.  **The Image**: Is the software (Nginx, Python) vulnerable?
2.  **The Registry**: Where do you download images from? (Docker Hub).
3.  **The Orchestrator**: Kubernetes (K8s) configuration.
4.  **The Runtime**: The Docker daemon running on the host.

### Ephemeral Nature
Containers live for minutes.
*   **SOC Nightmare**: "Alert: TCP scan from Container ID a1b2c3d4."
*   Analyst checks 10 minutes later. Container a1b2c3d4 is gone. Deleted.
*   *Solution*: You need specialized Container Security tools that log events *instantly* to a central database.