2 — eBPF Security

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

4 — Audit Logs

Kubernetes audit logs record every API server request as a structured, replayable trail of who-did-what-when, but a loosely scoped audit policy can silently omit the exact response stage where a compromise actually happened.

7 — Container Escape Techniques

Most container escapes exploit a workload's own misconfiguration — privileged mode, a hostPath mount, or a mounted container-runtime socket — rather than a kernel zero-day, making prevention primarily a policy problem, not a patching problem.

1 — Falco

Falco flags anomalous behavior by matching live kernel syscalls against declarative rules, catching threats that only manifest at runtime and never show up in a static image scan.

6 — Forensics

Container forensics is a race against ephemeral filesystems and pod rescheduling, so memory dumps, process trees, and network state must be captured at detection time, not after triage begins.