Software Development
Detecting Container Drift At Runtime
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.
- Publisher / source
- Cybersecurity Skills (Community)
- Upstream record
- mukul975/Anthropic-Cybersecurity-Skills
- Version
- Version 6
- Published
- Publication review
- Approved for publication
- Content fingerprint
5c5836f2d8abf0ba57cd9f7d4843cef2076f888da7c30de8c063771e9674987d