Secure Every Container Image and Running Container

Container security protects container images and the running containers built from them. It covers finding risk in images, testing suspicious images, deciding which images can deploy and controlling what containers do once they run. Aquasec covers each stage on one platform, with runtime policy enforced at the kernel layer.

Real time scanning keeps vulnerability results current without rescanning every image on a schedule. Scanners run next to your registries. When a new CVE is disclosed, unchanged images are checked against it without a full rescan, and updated images have only their changed layers scanned. Teams can also trigger a rescan on demand from the console or API.

Image scanning inspects an image’s contents for known vulnerabilities, malware indicators, secrets and misconfigurations. Dynamic Threat Analysis runs the image in an isolated sandbox and watches how it behaves, exposing malware, cryptominers, backdoors and container escape attempts that static analysis can miss.

Assurance Policies define the risk level an image must meet before it can deploy, based on findings such as vulnerability severity, malware, secrets and misconfigurations. Aquasec applies them as acceptance gates in CI/CD pipelines, and KubeEnforcer applies them as Kubernetes admission control, so images that fail policy are blocked before they start.

The Aquasec Enforcer operates inside the workload at the kernel layer, applying runtime policies such as Drift Prevention to deny supported unauthorized actions at the point of execution. Runtime Security extends the same protection to virtual machines and serverless functions.