Alternatives to Container Image Scanning for Detecting Runtime Threats

Container image scanning is a critical part of a secure software supply chain, but it catches vulnerabilities at rest, not attacks in progress. For detecting runtime threats, you need different tools and techniques that monitor behavior, network traffic, and system calls as your containers actually run. This article explores the most effective alternatives to image scanning for runtime threat detection, including when and why you’d use each one.

Why Image Scanning Isn’t Enough

Image scanners (like Trivy, Grype, or Clair) compare the packages and files in a container image against known vulnerability databases. They’re excellent for preventing known vulnerable components from ever running. But they have fundamental blind spots:

• Zero-day exploits: Scanners only know about vulnerabilities that are already published. A novel exploit or a misconfiguration that’s not in a CVE database won’t be flagged.
• Runtime misconfigurations: An image might be perfectly secure, but a runtime change (like a mounted secret or an exposed port) can introduce risk.
• Post-deployment changes: If an attacker exploits a vulnerability that was present at build time, image scanning won’t tell you about the ongoing attack.
• Lateral movement: Scanners can’t see whether a container is communicating with a suspicious IP or behaving erratically.

Runtime threat detection fills this gap by observing what containers actually do after they start.

Runtime Threat Detection: The Core Concept

Runtime detection tools monitor container behavior in real time and alert on suspicious activity. They typically use one or more of these data sources:

• System calls (syscalls): Every process makes system calls to the kernel. Unusual syscall patterns can indicate exploitation.
• Network traffic: Unexpected connections, ports, or protocols can signal malicious activity.
• File system access: Reads or writes to sensitive files (like /etc/shadow) outside normal patterns.
• Process execution: New processes spawning unexpectedly, or known binaries being invoked with odd arguments.

These tools can be agent-based (running on the host) or agentless (using kernel tracing). They often use eBPF (extended Berkeley Packet Filter) to safely hook into kernel events without modifying the kernel.

eBPF-Based Runtime Security

eBPF is a technology that lets you run sandboxed programs inside the Linux kernel to observe and even filter events. Several runtime security tools leverage eBPF to detect threats without the overhead of traditional agents.

How it works: eBPF programs attach to kernel tracepoints, kprobes, or uprobes. They collect data about syscalls, network packets, and file operations, then send that data to a userspace daemon for analysis. Because eBPF runs in the kernel, it has low overhead and can capture events that would be missed by userspace monitoring.

Examples: Falco (now a CNCF project) is the most popular eBPF-based runtime security tool. It uses rules to detect suspicious behavior, such as a shell spawning inside a container, or a process trying to read the host’s Docker socket. Cilium also uses eBPF for network security and can enforce policies at the kernel level.

Pros: High visibility, low overhead, works across all containers on a host. Cons: Requires Linux kernel 4.15+ (for most eBPF features), and writing custom rules can be complex.

Anomaly Detection and Behavioral Analysis

Instead of matching known attack signatures, anomaly detection builds a baseline of “normal” behavior for each container and flags deviations. This can catch zero-day exploits and insider threats that signature-based tools miss.

How it works: A learning period (often 24-48 hours) collects data on typical syscalls, network connections, CPU/memory usage, and file access. Then, a model (often statistical or machine learning-based) scores new behavior against that baseline. If a container suddenly starts making outbound connections to a never-before-seen IP address, or if a process begins writing to /etc/passwd, the anomaly detector raises an alert.

Pros: Can detect novel attacks. Cons: May produce false positives during legitimate changes (like a new feature deployment), and requires careful tuning to avoid alert fatigue.

Example: Some commercial tools like Sysdig Secure and Aqua Security offer anomaly detection modules, but you can also build your own using open-source libraries like scikit-learn.

Honeypots and Decoys

Honeypots are deliberately vulnerable services or containers placed in your environment to lure attackers. When an attacker interacts with a honeypot, you get an early warning and can study their tactics.

How it works: You deploy a container that mimics a real service but is actually isolated and monitored. Any connection, login attempt, or file access is recorded. Honeypots can be simple (e.g., a fake SSH server) or complex (e.g., a full emulated application).

Pros: Very low false positives (any activity is suspicious by definition). Cons: Only catches attackers who probe the honeypot; they don’t protect your real containers directly.

Example: The open-source project T-Pot is a multi-honeypot platform that can run in Docker. You can also use a simple tool like ssh-honeypotd.

Network Security Monitoring

While image scanning looks at the filesystem, network monitoring looks at the traffic between containers and the outside world. This is crucial because many attacks require network communication (e.g., data exfiltration, command-and-control).

Tools: You can use standard network monitoring tools like tcpdump, Wireshark, or Zeek, but container-specific tools like Cilium and Calico provide network policies and visibility at the container level.

Key signals: Unexpected DNS lookups, connections to known malicious IPs (using threat intelligence feeds), unusual protocols (e.g., SSH on port 443), or high volumes of traffic to a single destination.

Pros: Can detect attacks that don’t touch the filesystem. Cons: Encrypted traffic may hide the payload, and you need to handle TLS inspection carefully for privacy.

File Integrity Monitoring (FIM)

FIM tracks changes to critical files inside a container. If an attacker modifies a binary, adds a backdoor, or alters configuration files, FIM alerts you.

How it works: A baseline hash is taken of important files at container start. The tool then periodically re-checks those files and compares the hashes. Any change triggers an alert.

Example: Falco can be configured for FIM, or you can use dedicated tools like AIDE (Advanced Intrusion Detection Environment) inside a container.

Pros: Simple and effective for detecting tampering. Cons: High overhead if you monitor too many files, and it only catches changes after they happen (not the initial exploit).

How to Choose the Right Alternative

There’s no single “best” runtime detection tool; the right choice depends on your threat model, infrastructure, and team expertise.

• If you need low overhead and broad coverage: eBPF-based tools like Falco are a great starting point.
• If you’re worried about zero-days: Anomaly detection adds value but requires tuning.
• If you want to catch attackers early: Honeypots can be a low-effort addition.
• If you have strict compliance requirements: FIM may be mandatory (e.g., PCI-DSS).
• If you’re on a managed Kubernetes service: Check if your cloud provider offers built-in runtime detection (e.g., AWS GuardDuty, Azure Defender).

Combining Image Scanning with Runtime Detection

Image scanning and runtime detection are complementary, not mutually exclusive. A robust security strategy uses both:

1. Image scanning at build time to prevent known vulnerabilities from entering your environment.
2. Runtime detection to catch attacks that exploit unknown vulnerabilities, misconfigurations, or zero-days.

For example, you might use Trivy to scan images in CI/CD, and Falco to monitor running containers. If a vulnerability is found in production, you can use runtime detection to see if it’s being exploited while you patch.

Frequently Asked Questions

Can eBPF-based tools detect container escapes?

Yes, eBPF tools can often detect the syscalls that commonly lead to container escapes, such as unprivileged user namespace creation or attempts to mount the host filesystem. However, no tool can guarantee prevention; they just give you visibility.

What is the difference between a WAF and runtime detection?

A Web Application Firewall (WAF) inspects HTTP requests at the network layer and blocks malicious payloads. Runtime detection monitors the behavior of the application and the container itself. They address different layers: WAF is for incoming traffic, runtime detection is for what happens inside the container.

Do runtime detection tools work with all container runtimes?

Most tools work with Docker, containerd, and CRI-O because they all use the Linux kernel. However, some features (like eBPF) require specific kernel versions. For Windows containers, you’ll need a different approach (e.g., Microsoft Defender for Containers).

How much overhead do runtime detection tools add?

Well-implemented eBPF tools typically add less than 5% CPU overhead. Anomaly detection with machine learning can be heavier, especially during the learning phase. Honeypots have negligible overhead because they’re isolated.

Can I use runtime detection in a serverless environment?

Serverless platforms (like AWS Lambda) don’t give you access to the underlying kernel, so eBPF tools won’t work. Instead, you’d rely on platform-native monitoring (e.g., CloudWatch) and audit logs.

What should I do when a runtime alert fires?

First, isolate the container (e.g., pause it or remove it from the network). Then, investigate the alert context: what syscall, process, or network connection triggered it. Check if it’s a known false positive (e.g., a legitimate admin action). If it’s a real threat, capture forensic data (logs, core dumps) before killing the container.

Related

• Find Venmo Pending Split & Scheduled Payments
• Arc Raiders Grapple vs Snap Hook & Zipline
• Delete Files Off External Hard Drive Mac: Full Guide