# Kubernetes
All Kubernetes notes →1 — Falco
Falco flags anomalous behavior by matching live kernel syscalls against declarative rules, catching threats that only manifest at runtime and never show up in a static image scan.
2 — eBPF Security
eBPF lets security tooling observe and enforce policy directly in the kernel without loading custom kernel modules or injecting sidecars, trading portability risk for near-zero-overhead visibility.
3 — Runtime Threat Detection
Runtime threat detection catches attacks that exist only as live processes or in-memory payloads — exactly the class of compromise that image scanning and admission control cannot see because nothing malicious was ever written to disk.
4 — Audit Logs
Kubernetes audit logs record every API server request as a structured, replayable trail of who-did-what-when, but a loosely scoped audit policy can silently omit the exact response stage where a compromise actually happened.
5 — Incident Response
Kubernetes incident response means isolating a compromised pod with a NetworkPolicy or node cordon before killing it, because deleting it first destroys the ephemeral evidence needed to determine how the attacker got in.
6 — Forensics
Container forensics is a race against ephemeral filesystems and pod rescheduling, so memory dumps, process trees, and network state must be captured at detection time, not after triage begins.
7 — Container Escape Techniques
Most container escapes exploit a workload's own misconfiguration — privileged mode, a hostPath mount, or a mounted container-runtime socket — rather than a kernel zero-day, making prevention primarily a policy problem, not a patching problem.
8 — Mitigations
Layered runtime controls — seccomp profiles, AppArmor/SELinux, Pod Security Admission, and non-root enforcement — each close a different escape vector, so relying on any single control leaves the others wide open.
9 — Security Monitoring
Security monitoring only works when signals from the control plane (audit logs), the kernel (eBPF/Falco), and the network (CNI flow logs) are correlated together, since any single layer alone leaves a blind spot an attacker can walk through.