Platform Security
Platform Security covers the controls built around workloads: the supply chain that produces images, the runtime that executes them, and the platform services that isolate tenants.
Supply chain
Scan images in CI and continuously in the registry; prefer minimal or distroless bases to shrink CVE surface. Generate an SBOM (SPDX or CycloneDX) per artifact. Sign images with cosign/Sigstore and verify signatures and attestations at admission (Kyverno verifyImages, Sigstore policy-controller) so unsigned or unapproved images cannot run. Pin images by digest rather than a mutable tag such as latest, and pull only from a controlled registry. SLSA provenance levels describe how trustworthy the build record is.
Runtime and isolation
Run as non-root with a read-only root filesystem, drop capabilities, apply seccomp and AppArmor. Use runtime detection (Falco) for behavioural anomalies: a shell inside a container, writes to /etc, cryptomining patterns. Sandboxed runtimes - gVisor, Kata Containers - add a kernel boundary for untrusted workloads. Egress NetworkPolicy and a service mesh with mTLS limit lateral movement and encrypt service-to-service traffic.
Host and secrets
Use CIS-hardened, minimal node images, automated patching, restricted SSH, and no runtime socket exposure. Keep secrets in an external manager (Vault, a cloud secret manager) delivered through the Secrets Store CSI driver or External Secrets rather than committed manifests. Back up etcd and test restores.
Worked example
An unsigned image from a public registry ran in production. The fix is not only scanning: pin the base image, build in CI, generate an SBOM, sign with a key held in KMS, and add an admission policy rejecting images whose signature does not verify against the expected identity - then alert on rejected admissions.
Traps
Scanning only at build time and never at admission; treating an SBOM as a signature; assuming a sandbox replaces NetworkPolicy; assuming a service mesh secures traffic that bypasses the sidecar.