NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cloud Security
Container Runtime Security
Master the defense of active container workloads. Learn to detect container escapes, monitor system calls with eBPF, and respond to runtime threats.
Room tasks
1What Is Runtime Security and Why Does It Matter
2Container Escape Techniques
3Guided Lab: Detecting a Container Escape Attempt
Frequently Asked Questions
What is container runtime security?
It is the protection of containers while they run, using monitoring and policy to detect suspicious behavior such as unexpected processes, file changes or privilege escalation that image scanning cannot catch.
How does Falco detect threats?
Falco watches system calls, often via eBPF, and compares activity against rules. When a container spawns a shell or reads sensitive files unexpectedly, it raises an alert for investigation.
What is a container escape?
A container escape is when an attacker breaks out of container isolation to reach the host or other containers, often through kernel flaws or risky settings. This free advanced room covers detection.