3 — Runtime Threat Detection

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

4 — Audit Logs

Kubernetes audit logs record every API server request as a structured, replayable trail of who-did-what-when, but a loosely scoped audit policy can silently omit the exact response stage where a compromise actually happened.

7 — Container Escape Techniques

Most container escapes exploit a workload's own misconfiguration — privileged mode, a hostPath mount, or a mounted container-runtime socket — rather than a kernel zero-day, making prevention primarily a policy problem, not a patching problem.

2 — eBPF Security

eBPF lets security tooling observe and enforce policy directly in the kernel without loading custom kernel modules or injecting sidecars, trading portability risk for near-zero-overhead visibility.

1 — Falco

Falco flags anomalous behavior by matching live kernel syscalls against declarative rules, catching threats that only manifest at runtime and never show up in a static image scan.