Open-Source Cybersecurity Tools: Container & Kubernetes Security
← Back to Open-Source Cybersecurity Tools Hub | Full Open Source Catalog | Main Atlas
This category contains 7 documented tools. It focuses on capabilities used for image integrity checks, cluster policy enforcement, and runtime threat detection. Use this section when building shortlists, comparing operational tradeoffs, and mapping controls to detection/response ownership.
Category Evaluation Checklist
- Coverage depth against your highest-priority threats and compliance obligations.
- Operational overhead for deployment, tuning, and long-term maintenance.
- Signal quality versus analyst workload and false-positive pressure.
- Integration fit with SIEM, ticketing, identity, cloud, and engineering workflows.
- Governance readiness including auditability, ownership clarity, and change control.
Jump by Name
Letter B
This letter section contains 2 tools.
Bane
- Website: https://github.com/genuinetools/bane
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Bane is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Custom and better AppArmor profile generator for Docker containers.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps.
Bunkerized-nginx
- Website: https://github.com/bunkerity/bunkerized-nginx
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Bunkerized-nginx is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Docker image of an NginX configuration and scripts implementing many defensive techniques for Web sites.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > Security configurations.
Letter C
This letter section contains 1 tools.
Clair
- Website: https://github.com/coreos/clair
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Clair is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Static analysis tool to probe for vulnerabilities introduced via application container (e.g., Docker) images.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps.
Letter D
This letter section contains 1 tools.
DShield docker
- Website: https://github.com/xme/dshield-docker
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Honeypots
What it does: DShield docker is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Docker container running cowrie with DShield output enabled.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Contents > Honeypots.
Letter O
This letter section contains 1 tools.
Oriana
- Website: https://github.com/mvelazc0/Oriana
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Threat Detection
What it does: Oriana is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Lateral movement and threat hunting tool for Windows environments built on Django comes Docker ready.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Threat Detection and Hunting > Tools.
Letter S
This letter section contains 1 tools.
Snyk
- Website: https://snyk.io/
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Snyk is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Finds and fixes vulnerabilities and license violations in open source dependencies and container images.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps.
Letter T
This letter section contains 1 tools.
Teleport
- Website: https://goteleport.com/
- Model: Open Source
- Category: Container & Kubernetes Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Teleport is used in container & kubernetes security programs to support image integrity checks, cluster policy enforcement, and runtime threat detection. Source summaries describe it as: Allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > Communications security (COMSEC).