Cloud-Native Security & DevSecOps
The cloud-native stack quietly moves the security boundary, and most bugs here come from not noticing where it went. A container is not a lightweight virtual machine — it is an ordinary host process that the kernel gave an isolated view of the system through namespaces and cgroups, over one shared kernel. That single fact is why privileged: true, a hostPath mount, hostPID, or a mounted container-runtime socket are not "extra options" but node-level access, and why Kubernetes — which repeats every such setting across a fleet — needs least-privilege RBAC, deny-by-default networking, and admission control rather than trust.
Security also moves earlier — "left" — into the pipeline that builds the artifact, and upward into the compliance regimes that audit the whole thing. A scanner only helps if its findings are trusted and acted on; a gate that cries wolf is routed around within a week; and passing an audit proves controls exist, which is a different claim from being secure. The three layers below build the model.
Topic map
- Container & Kubernetes security — why a container is not a VM boundary, how to shrink a container's blast radius, the image supply chain, and the cluster controls (RBAC, Secrets encryption, NetworkPolicy, Pod Security Admission) that keep one compromise contained.
- DevSecOps pipelines — shifting security left with SAST/DAST/IAST/SCA, triaging findings so the tooling stays trusted, supply-chain and secrets discipline, pipeline hardening, and gates that block by risk rather than by raw severity.
- Compliance — why compliance is not security, the major regimes at engineer depth (GDPR, PCI DSS, SOC 2, ISO 27001, HIPAA), and how policy, controls and machine-emitted evidence turn into an audit you can pass honestly.
Common traps
| Mistake | Consequence |
|---|---|
| Treating a container as a VM-grade boundary | privileged/hostPath/socket mounts are read as harmless; an escape lands you on the node |
| Trusting a Kubernetes Secret because it is not plaintext | base64 is encoding, not encryption — without etcd encryption at rest a leaked backup is a leaked secret |
| Making every scanner finding block the build | Noise trains teams to disable or route around the gate within a week |
| Reading a CVSS score as a priority | Priority is exploitability plus exposure; a critical score on unreachable code is not an emergency |
| Equating a passed audit with security | Compliance proves controls exist on paper, not that the system resists a real attacker |
Interview relevance
This topic checks whether you can build into a cloud-native stack safely rather than recite tool names. A candidate who says "a container shares the host kernel, so privileged is node access, and a Kubernetes Secret is base64 until etcd encryption is on" is instantly ahead of one who calls a container a sandbox and a Secret encrypted. The strongest answers connect all three layers: a hardened image, shipped through a trusted gate, under a control an auditor can verify.