Orca: 8 Container Security Best Practices for 2026

What it is

Orca's container security checklist, organized as build-time, deploy-time and runtime controls. The summary lists the controls. This note keeps the page's precision points: what each control does not cover, and the settings that are commonly misconfigured or misdescribed.

What to do

Settings the page names:

• Pod securityContext: runAsNonRoot and runAsUser, readOnlyRootFilesystem: true, and capabilities.drop: ["ALL"], adding back only what the app needs. Treat SYS_ADMIN as especially sensitive.
• Service accounts: one per workload, and automountServiceAccountToken: false for pods that don't call the Kubernetes API. Avoid verbs: ["*"] and resources: ["*"] in RBAC rules. Review any account that can create or update workloads, since that permission can undermine pod-security controls.
• Docker socket: never mount it into a container. It lets the container launch privileged containers and mount the host filesystem.
• etcd encryption: configure the EncryptionConfiguration API for Secrets and other sensitive resources, then verify that existing resources are rewritten so they are encrypted in storage. Without that, the default identity provider stores plaintext.
• Patch priority: rebuild images that carry CISA KEV-listed CVEs first, regardless of CVSS score, because KEV means observed exploitation. Trigger dependent image builds from registry webhooks when the base image updates.
• Incident response for pods: before terminating a compromised pod, capture its filesystem snapshot and process list. Also capture Kubernetes audit events for the namespace covering the period before detection, and record the running image digest so you can trace it to the CI/CD run that built it.
• Audit retention: PCI DSS v4.0.1 requirement 10.5.1 requires at least 12 months of audit log history, with recent logs available for analysis. The page's HIPAA note says the six-year retention language applies to required Security Rule documentation, not to logs generally.
• Drift checks: run CIS Kubernetes Benchmark checks (the page cites v2.0.1) on a schedule against live cluster state, not just at point-in-time reviews.

Caveats

Corrections and gaps the page states that are easy to get wrong:

• Alpine is not distroless. It still ships a package repository and apk. Distroless and hardened images omit shells, package managers and debug tools.
• Restricted is not the whole list. The Pod Security Admission Restricted profile builds on Baseline. It requires non-root execution, no privilege escalation, a seccomp profile, and dropping all capabilities except NET_BIND_SERVICE when explicitly added. readOnlyRootFilesystem is a separate hardening setting and is not required by Restricted. Enforce Restricted per namespace only where workloads can meet it.
• NetworkPolicy needs a CNI that enforces it. Policy objects can exist and do nothing. Calico and Cilium are the examples given. Audit enforcement, not just object existence.
• Non-root is partial. It reduces escape impact "depending on the runtime and host configuration."
• Service account tokens are short-lived by default from Kubernetes v1.22, but a compromised container can still use them within their scope.
• No single tool covers all phases. Trivy, Grype and Clair cover build. Gatekeeper and Kyverno cover admission. Falco and Tetragon cover runtime. Each lacks the others' coverage. Tetragon can also block or react to selected kernel events, not just alert.
• Image scanning misses zero-days and attacks that use no known CVE.
• Managed Kubernetes (EKS, AKS, GKE) secures the control plane only. Pod security, RBAC/IAM, images and many network controls stay with the customer, and exact splits vary by provider and cluster mode.
• Compliance mappings are hedged. SBOM formats (SPDX, CycloneDX via Syft) support EO 14028 expectations but don't satisfy procurement or attestation requirements on their own. FedRAMP needs mapping to the applicable baseline.
• The Orca section is a vendor pitch. The page's closing claim is that SideScanning adds cloud context (exposure, identity permissions, sensitive-data risk) for prioritization. Nothing there is independently verified.