Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

Container Sentinel | Image & Admission Audit

Container image auditor that grades base image currency, root execution, added Linux capabilities, layer-embedded secrets, digest pinning, and package CVEs, then renders the admission decision a gate would make.

Live demo readyContainer Security + Docker
Container SecurityDockerSupply ChainCVE ScanningAdmission ControlDevSecOpsCase study / interactive demo

Case study

From problem to working system

Problem

Container image auditor that grades base image currency, root execution, added Linux capabilities, layer-embedded secrets, digest pinning, and package CVEs, then renders the admission decision a gate would make.

My role

Security engineer and full-stack developer

Solution

Container image auditor that grades base image currency, root execution, added Linux capabilities, layer-embedded secrets, digest pinning, and package CVEs, then renders the admission decision a gate would make.

Architecture

The implementation combines the following technologies and system concerns.

Container SecurityDockerSupply ChainCVE ScanningAdmission ControlDevSecOps

How it was built

  • Audited what actually leads to container compromise: root execution, added capabilities, and secrets baked into layers, not only the CVE list.
  • Treated SYS_ADMIN as equivalent to privileged, since in practice it is a container escape primitive rather than a fine-grained grant.
  • Flagged secrets in image layers as critical, because anyone who can pull the image can read them regardless of runtime configuration.
  • Measured base image age, which is the single variable that determines most of an image's CVE count.

Security decisions

  • Audited what actually leads to container compromise: root execution, added capabilities, and secrets baked into layers, not only the CVE list.

Major challenges

  • Audited what actually leads to container compromise: root execution, added capabilities, and secrets baked into layers, not only the CVE list.
  • Treated SYS_ADMIN as equivalent to privileged, since in practice it is a container escape primitive rather than a fine-grained grant.
  • Flagged secrets in image layers as critical, because anyone who can pull the image can read them regardless of runtime configuration.

Verified evidence

Results and measurable impact

  • Flagged secrets in image layers as critical, because anyone who can pull the image can read them regardless of runtime configuration.
  • Measured base image age, which is the single variable that determines most of an image's CVE count.
  • Required digest pinning so a rebuild cannot silently change the base image underneath the application.
  • Rendered a concrete admission verdict rather than a report, since a scanner that does not gate is documentation.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

Container Sentinel

Security platform

Container SentinelWorkspace1 updates
Container Sentinel · Image Auditapp/legacy-worker:latest admission posture
DENY · 8

An image scan that only lists CVEs misses what actually gets containers compromised: running as root, added capabilities, secrets baked into layers, and a base image nobody has rebased in two years. Each finding below names the mechanism and the fix, and the admission gate blocks on critical or high.

Posture score

0

admission would block

Base

ubuntu

640d old · 1180 MB

Runs as

root

SYS_ADMIN, NET_RAW

CVEs

4

across 3 tracked packages

Posture10 findings
0denied
Image specification
Baseubuntu:20.04Base age640 daysSize1180 MBUserroot (UID 0)CapabilitiesSYS_ADMIN, NET_RAWReferencemutable tag

Admission denied: 8 finding(s) at high or above. Root execution and layer-embedded secrets must be resolved before this image can be deployed.

Findings
openssl 1.1.1f is affected by CVE-2024-2511high

Fix: Rebuild on a current base so openssl is updated; pinning the package alone leaves the rest of the base stale.

openssl 1.1.1f is affected by CVE-2025-1188critical

Fix: Rebuild on a current base so openssl is updated; pinning the package alone leaves the rest of the base stale.

curl 7.68.0 is affected by CVE-2025-0665high

Fix: Rebuild on a current base so curl is updated; pinning the package alone leaves the rest of the base stale.

python3 3.8.10 is affected by CVE-2025-4517high

Fix: Rebuild on a current base so python3 is updated; pinning the package alone leaves the rest of the base stale.

Container runs as UID 0high

Fix: Add a non-root USER and chown only what the process needs to write.

Added capabilities: SYS_ADMIN, NET_RAWcritical

Fix: Drop ALL then add back only what is required. SYS_ADMIN is effectively container escape.

Base image is 640 days oldhigh

Fix: Rebase onto a current tag and rebuild on a schedule, not only on code change.

1 secret(s) baked into image layerscritical

Fix: Secrets in a layer are readable by anyone who can pull the image. Rotate them, then move to build-time mounts or runtime injection.

Base image referenced by mutable tagmedium

Fix: Pin by digest so a rebuild cannot silently change the base out from under you.

No HEALTHCHECK definedlow

Fix: Add one so the orchestrator can tell a hung process from a healthy one.

Zain Khalil Khan