What Is Kubernetes?

Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications across clusters of machines. While originally developed by Google, Kubernetes is now maintained by the Cloud Native Computing Foundation, and serves to address the operational challenges that emerge when managing hundreds or thousands of containers across multiple servers.

Kubernetes Architecture

Kubernetes consists of two main components: a control plane that manages cluster state and worker nodes that run containerized applications. The control plane houses the following units:

  • The API server: Front door for all interactions
  • The etcd database: Cluster memory storing all configuration data
  • The scheduler: Assigns pods to appropriate nodes
  • The controller manager: Maintains the desired state across the cluster

Meanwhile, the worker nodes are the most minor deployable units in Kubernetes that can contain one or more containers. They host three components:

  • Kubele: Node agent that communicates with the control plane
  • Kube-Proxy: Handles networking and load balancing)
  • Container runtime: containerd, CRI-O, or Docker

Kubernetes Security Considerations

Kubernetes implements its security through Role-Based Access Control (RBAC), network policies for controlling pod communication, and Pod Security Standards that enforce security constraints on pods. However, configuration challenges persist across organizations.

Kubernetes Vulnerability Statistics

A 2024 report on Kubernetes security found that 67% of respondents, comprising DevOps, engineering, and security professionals, reported delaying or slowing down application deployments due to Kubernetes security concerns.

Almost half of the respondents report adverse effects from container and Kubernetes security incidents, including revenue loss and fines.

Meanwhile, a Kubernetes Benchmark Report in 2024 analyzed over 330,000 workloads from hundreds of organizations, and it found that security for Kubernetes shows mixed progress:

  • Organizations with 90%+ workloads having insecure capabilities dropped from 33% to 28%, but 70% still run outdated Helm charts, missing critical patches. Outdated Helm charts create a blind spot where essential security patches have yet to be applied, leaving known attack vectors exposed across your deployments.
  • 30% of organizations still allowed 71% or more of their workloads root access, compared to 44% the previous year. While this shows improvement, running containers as root remains a critical security risk.

Organizations with high root access rates face exponentially higher breach potential, as compromised root containers can easily escalate to complete host control.

Recent Critical CVEs

Several high-impact vulnerabilities affected Kubernetes environments in 2024:

  • CVE-2024-6387: SSH daemon vulnerability with CVSS 8.1, exploiting race conditions in SIGALRM handlers
  • CVE-2024-3094: XZ Utils backdoor with maximum CVSS 10.0 severity, affecting compression tools used in container environments
  • CVE-2024-21626: RunC container escape vulnerability with CVSS 8.6, allowing attackers to break container isolation

What Is Docker?

Docker packages applications and their dependencies into lightweight, portable containers. The platform employs a client-server architecture, where the Docker daemon manages container lifecycles, while the Docker CLI (command-line tool) enables users to build, run, and manage containers.

Docker eliminates the “works on my machine” problem that plagues development teams by creating consistent environments. With over 26 billion image downloads and 29 million unique IP addresses pulling monthly, Docker Hub is the world’s largest container registry, demonstrating Docker’s widespread adoption across development workflows.

Core Docker Architecture Components

Docker’s architecture consists of several components that create and manage containers:

1. Docker CLI (Command Line Interface). The primary way users interact with Docker is through commands like docker run, docker build, docker push, and docker pull. The CLI communicates with the Docker daemon via REST API calls.

2. Docker Daemon (dockerd). The background service that manages Docker objects including images, containers, networks, and volumes. The daemon listens for API requests and processes commands, such as creating containers or pulling images.

3. Dockerfile. A text file containing step-by-step instructions to build Docker images. It defines the base image, copies application code, installs dependencies, and configures the runtime environment.

4. Container Runtime. Docker Engine uses containerd for managing container lifecycles, which interfaces with runc (an OCI-compliant runtime) to actually create and run containers.

5. Docker Registry. Centralized storage for Docker images. Docker Hub serves as the default public registry, while organizations can maintain private registries for proprietary images.

6. Networking. Docker provides multiple network drivers, including bridge (default for single-host communication), host (removes network isolation), overlay (multi-host networking), and macvlan (assigns MAC addresses to containers).

Docker Security Considerations

According to a recent report, 86% of workloads running in production contain patchable vulnerabilities of high or greater severity.

Docker Vulnerability Statistics

A recent analysis of 70 randomly selected container images from Docker Hub’s 250 most commonly downloaded images revealed that the average container had 604 known vulnerabilities in its underlying software components, with over 45% being 2 to 10 years old or older.

This same research also found that 1 in 8 components in container images had no software manifest, lacking formal metadata about dependencies and version details. Over 4% of the 16,557 identified CVEs with a Critical or High CVSS severity were weaponized vulnerabilities known to botnets for spreading ransomware or used in known attacks.

What these mean for Docker deployments is that organizations may be unknowingly deploying containers built on decade-old, vulnerable foundations. At the same time, the absence of software manifests creates blind spots that prevent effective vulnerability management.

The concentration of weaponized CVEs indicates that attackers have readily available exploit paths against the most commonly used container images.

Recent Critical Docker Vulnerabilities

CVE-2025-9074 (January 2025): A critical container escape vulnerability with CVSS 9.3 affecting Docker Desktop for Windows and macOS. The flaw allowed malicious containers to access the Docker Engine API at 192.168.65.7:2375 without authentication, enabling unauthorized host access.

CVE-2024-8695 & CVE-2024-8696 (September 2024): Two remote code execution vulnerabilities in Docker Desktop Extensions had Critical and High severity ratings, respectively. These allowed malicious extensions to execute arbitrary code through crafted descriptions and URLs.

When deploying Docker containers, you’ll need to implement comprehensive vulnerability scanning and management processes throughout the development lifecycle.

Your DevOps teams need sophisticated forensic capabilities to investigate container-related security incidents. When you understand how attackers exploit CI/CD pipelines and container infrastructure, you’re also creating better defenses against these future attacks.

Learn more about forensic investigation of development environments and CI/CD security in Group-IB’s analysis of GitLab and Jenkins Forensics.

Key Differences Between Kubernetes and Docker

While Docker serves as the engine that builds and runs containers, Kubernetes is the system that manages and orchestrates them at scale.

Architectural Approaches

Docker uses a simple client-server model with a centralized daemon handling all container operations. This design makes Docker easy to use and perfect for rapid development workflows.

Meanwhile, Kubernetes takes a different approach with a distributed architecture where multiple components work together to manage clusters of machines, focusing on reliability and scalability for production environments.

Deployment and Management Scope

Docker works well for small-scale and straightforward deployments, while Kubernetes handles large-scale and complex containerized applications. Docker is a good choice for creating and running individual containers on single hosts.

However, Kubernetes may be a better option if you’re orchestrating complex distributed applications across multiple nodes with automated scaling and health monitoring.

Runtime Security Models

Docker and Kubernetes approach runtime security differently due to their distinct architectural roles:

  • Docker’s Security Model: Focuses on container-level isolation using Linux namespaces, cgroups, and seccomp profiles. The Docker Engine handles security at the individual container level, with features like user namespaces to prevent privilege escalation and AppArmor/SELinux integration for mandatory access controls.
  • Kubernetes Security Model: Implements cluster-wide security policies through Pod Security Standards, network policies, and RBAC. Kubernetes runs security across multiple nodes, managing secret distribution, service account permissions, and enforcing security contexts for entire workloads.

Learn more about protecting containerized workloads and cloud infrastructure threats your team should know about.

Kubernetes With Docker: Can They Work Together?

Kubernetes and Docker complement each other. Docker is a containerization platform and runtime, while Kubernetes is a platform for running and managing containers from many container runtimes. Kubernetes supports numerous container runtimes, including Docker.

Container Runtime Evolution

Kubernetes deployments support multiple container runtime options through the Container Runtime Interface (CRI). While Docker historically served as the default runtime, Kubernetes 1.24 removed dockershim support in favor of CRI-compatible alternatives, such as containerd and CRI-O, which deliver improved performance and security.

Integration Patterns

Organizations typically use Docker for development and image building, while utilizing Kubernetes for production orchestration. This separation allows your development teams to maintain familiar Docker workflows, while your operations teams benefit from Kubernetes’ advanced orchestration capabilities for managing production workloads at scale.

See how Group-IB’s Security Assessment services identify vulnerabilities across development and production container environments.

Use Cases Where Kubernetes Is Better

Kubernetes has advantages over Docker in enterprise environments that need scalability, reliability, and more sophisticated operational capabilities. One of its key strengths is its ability to scale applications up or down as demand changes. This feature helps you meet user needs without wasting resources, cutting costs, and improving application performance.

Multi-Cloud and Hybrid Deployments

With Kubernetes, applications can run across different cloud environments or in hybrid deployments that combine cloud and on-premise infrastructure. This portability helps organizations avoid vendor lock-in and optimize costs across multiple infrastructure providers.

Microservices Architectures

Large-scale microservices deployments gain significant advantages from Kubernetes’ service discovery, inter-service communication, and configuration management capabilities. The platform’s namespace isolation and RBAC policies create security boundaries that complex distributed systems need.

Enterprise Security and Compliance

If you work with strict security requirements, you can leverage Kubernetes’ comprehensive security model, including pod security policies, network policies, and secrets management. Advanced threat detection and monitoring capabilities become essential for protecting containerized applications against sophisticated attacks.

Digital risk extends beyond traditional infrastructure to encompass the entire digital footprint of modern organizations. On the other hand, brand protection and digital asset security also require continuous monitoring across multiple attack vectors.

Explore comprehensive digital asset protection strategies in Group-IB’s guide to Digital Risk Protection.

Use Cases Where Docker Is Preferred

Docker works best when you need simplicity, rapid development, and lightweight orchestration. Docker Swarm handles small to medium-sized jobs well, but may struggle to keep up with Kubernetes when dealing with large setups that have thousands of containers.

Development Environment Standardization

Docker’s primary strength lies in creating consistent development environments across team members. The platform eliminates configuration drift and dependency conflicts that commonly plague software development projects. With Docker, your teams can share identical environments regardless of their underlying operating systems.

Single-Host Applications

Docker Swarm provides sufficient orchestration capabilities for applications that run within single data centers or with individual cloud providers. These scenarios benefit from Docker’s straightforward deployment model, which eliminates the complexity overhead of full Kubernetes orchestration.

Resource-Constrained Environments

Small businesses running limited containerized applications on constrained hardware resources find Docker’s lightweight approach more suitable than full Kubernetes deployments, which consume significant system resources for cluster management overhead.

How Group-IB Secures Containerized Environments

Container security requires comprehensive protection across the entire application lifecycle. Group-IB’s Security Assessment services help organizations identify vulnerabilities from image security to orchestration platform configurations.

Your containerized applications face many risks beyond traditional infrastructure security. If you’re deploying containers across distributed environments, you need visibility into the entire digital footprint.

Group-IB’s Digital Risk Protection monitors for brand abuse and code repository exposures, while Attack Surface Management continuously discovers external assets, including shadow IT and misconfigurations that can impact cloud infrastructure security.

Contact our experts today to secure your containerized infrastructure against evolving cyber threats.