container-security.dev

What It Is

Container Security Book is a Japanese online document published with HonKit, positioned as a resource for learning Linux container security. The text clearly states that the document is still under development, and that its target readers are people who “use containers regularly but do not understand the underlying container technologies or security.” It is not a live or recorded course in the traditional sense; it is closer to an open-source e-book or technical manual.

Core Content and Format

Judging from the table of contents, it covers foundational container technologies such as Namespace, chroot/pivot_root, Capability, Seccomp, AppArmor, and cgroup. It also addresses container attacks and hardening, including container escape, sensitive file mounts, DoS, image scanning, No New Privileges, and CIS Benchmark. The Kubernetes section covers Metadata Service, hostPath escape, Pod privileges, excessive ServiceAccount permissions, etcd, and Secret Management. The captured page’s chapter on ServiceAccount includes examples using curl, kubectl, and YAML manifests, indicating a hands-on approach with analysis of low-level mechanisms.

Pricing, Certificates, and Instructors

The main text does not mention fees, subscriptions, payment methods, or corporate training, so it can be considered free to read online. The source code is under the MIT License, while the articles use CC BY-NC 4.0. There is no information about certification, completion certificates, instructor backgrounds, or institutional endorsement, so it is not suitable for users who need formal credentials or course-style services.

Pros and Cons

Its strengths are its highly focused topic coverage and its treatment of key aspects of container security, from principles and attacks to hardening. The examples are also practical from an engineering perspective. The open-source repository supports Issues and Pull Requests, which helps with ongoing corrections and improvements. Its drawbacks are that the documentation is still under development, so completeness may be limited; it is written in Japanese, which creates a barrier for Chinese learners; and it does not provide video explanations, exercises, Q&A support, or learning progress management.

Who It’s For and Access from China

It is suitable for DevOps engineers, cloud-native engineers, security engineers, and learners who want to understand Kubernetes RBAC, ServiceAccount Token, and container escape risks. It is not beginner-friendly; users should ideally have a foundation in Linux, Docker/Kubernetes, and the command line. Access from China cannot be determined from the main text. If access is unstable, alternatives include the official Kubernetes documentation, CIS Benchmark, cloud vendor container security documentation, or Chinese-language cloud-native security courses.