Free Container Security Tools
Secure containers and Kubernetes clusters with free and open source tools. Browse container image scanners, runtime security, Kubernetes policy enforcement, and supply chain security tools.
Showing 24 of 269 tools
portainer
portainer/portainer
Making Docker and Kubernetes management easy.
slim
slimtoolkit/slim
Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
kubescape
kubescape/kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
kube-bench
aquasecurity/kube-bench
Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark
kubernetes-learning-path
techiescamp/kubernetes-learning-path
A roadmap to learn Kubernetes from scratch (Beginner to Advanced level)
kata-containers
kata-containers/kata-containers
Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/
podman-desktop
podman-desktop/podman-desktop
Podman Desktop is the best free and open source tool to work with Containers and Kubernetes for developers. Get an intuitive and user-friendly interface to effortlessly build, manage, and deploy containers and Kubernetes — all from your desktop.
cri-o
cri-o/cri-o
Open Container Initiative-based implementation of Kubernetes Container Runtime Interface
kubernetes-goat
madhuakula/kubernetes-goat
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
lxc
lxc/lxc
LXC - Linux Containers
kube-hunter
aquasecurity/kube-hunter
Hunt for security weaknesses in Kubernetes clusters
pouch
AliyunContainerService/pouch
An Efficient Enterprise-class Container Engine
diun
crazy-max/diun
Receive notifications when an image is updated on a Docker registry
krustlet
krustlet/krustlet
Kubernetes Rust Kubelet
kubernetes-client
fabric8io/kubernetes-client
Java client for Kubernetes & OpenShift
nsjail
google/nsjail
A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.
SecretScanner
deepfence/SecretScanner
:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:
dockle
goodwithtech/dockle
Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start
kube-score
zegl/kube-score
Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.
kubernetes-security-best-practice
freach/kubernetes-security-best-practice
Kubernetes Security - Best Practice Guide
compose-spec
compose-spec/compose-spec
The Compose specification
kube-capacity
robscott/kube-capacity
A simple CLI that provides an overview of the resource requests, limits, and utilization in a Kubernetes cluster
kopf
nolar/kopf
A Python framework to write Kubernetes operators in just a few lines of code
kubectl-debug
aylei/kubectl-debug
This repository is no longer maintained, please checkout https://github.com/JamesTGrant/kubectl-debug.
Related Security Domains
Frequently Asked Questions
What is the best free container image scanner?
Trivy is the most widely used free container image vulnerability scanner, covering OS packages, language dependencies, and misconfigurations in a single tool. Grype and Clair are strong alternatives. Snyk Container offers a free tier for individual developers.
How do I secure a Kubernetes cluster?
Key steps include: enable RBAC, use network policies to restrict pod communication, scan images before deployment with Trivy or Grype, enforce pod security standards, use Falco for runtime threat detection, and audit with kube-bench against CIS Kubernetes Benchmarks.
What is Falco?
Falco is an open source cloud-native runtime security tool that detects unexpected behavior in containers and Kubernetes workloads using kernel system call monitoring. It can alert on privilege escalation, unexpected network connections, and file system access in real time.
What is the software supply chain and how do I secure it?
The software supply chain includes all components, dependencies, and processes used to build and deploy software. Attacks like SolarWinds and Log4Shell highlighted supply chain risks. Tools like Syft (SBOM generation), Grype (vulnerability scanning), and Sigstore (artifact signing) help secure the supply chain.