Container Security Monitoring Architecture

Container Security Monitoring Architecture

Effective container security monitoring requires a multi-layered approach capturing data from hosts, containers, orchestrators, and applications. The monitoring architecture must handle high-volume, high-velocity data streams while maintaining sufficient detail for security analysis. Traditional monitoring tools often struggle with container dynamics, requiring purpose-built solutions or significant adaptations.

Container monitoring data sources include system calls, network traffic, file access, process execution, and orchestrator events. Each data source provides different security insights. System calls reveal container behavior at the kernel level. Network monitoring identifies lateral movement and data exfiltration. File access monitoring detects unauthorized modifications. Process monitoring catches malicious execution. Orchestrator events provide context about container lifecycle and configuration changes.

Data collection strategies must balance completeness with performance impact. Agent-based monitoring provides deep visibility but consumes container resources. Agentless monitoring through eBPF reduces overhead but may miss some events. Sidecar containers offer compromise between visibility and resource usage. Organizations should choose collection strategies based on security requirements and performance constraints.

# Example: Comprehensive container monitoring stack
version: '3.8'

services:
  # Falco for runtime security monitoring
  falco:
    image: falcosecurity/falco:latest
    privileged: true
    volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
      - /proc:/host/proc:ro
      - /boot:/host/boot:ro
      - /lib/modules:/host/lib/modules:ro
      - /usr:/host/usr:ro
      - /etc:/host/etc:ro
      - ./falco-rules:/etc/falco/rules.d:ro
    environment:
      - HOST_ROOT=/host
    command: ["/usr/bin/falco", "-pk", "-o", "json_output=true", "-o", "http_output.enabled=true", "-o", "http_output.url=http://falco-exporter:2801"]

  # Falco exporter for Prometheus integration
  falco-exporter:
    image: falcosecurity/falco-exporter:latest
    ports:
      - "9376:9376"
    environment:
      - FALCO_EXPORTER_PROMETHEUS_ENDPOINT=/metrics
      - FALCO_EXPORTER_LISTEN_ADDRESS=0.0.0.0:9376

  # Sysdig for deep container visibility
  sysdig-agent:
    image: sysdig/agent:latest
    privileged: true
    network_mode: host
    pid: host
    volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
      - /proc:/host/proc:ro
      - /boot:/host/boot:ro
      - /lib/modules:/host/lib/modules:ro
      - /usr:/host/usr:ro
      - /var/lib/sysdig:/var/lib/sysdig
    environment:
      - ACCESS_KEY=${SYSDIG_ACCESS_KEY}
      - COLLECTOR_PORT=6443
      - SECURE=true
      - CHECK_CERTIFICATE=true
      - SYSDIG_AGENT_DRIVER=universal_ebpf

  # Elasticsearch for log aggregation
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.10.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.enrollment.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
    volumes:
      - esdata:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"

  # Kibana for visualization
  kibana:
    image: docker.elastic.co/kibana/kibana:8.10.0
    environment:
      - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

  # Fluent Bit for log collection
  fluent-bit:
    image: fluent/fluent-bit:latest
    volumes:
      - ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/log:/var/log:ro
    environment:
      - FLUENT_ELASTICSEARCH_HOST=elasticsearch
      - FLUENT_ELASTICSEARCH_PORT=9200
      - FLUENT_ELASTICSEARCH_USER=elastic
      - FLUENT_ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}

  # Prometheus for metrics
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=30d'
    ports:
      - "9090:9090"

  # Grafana for dashboards
  grafana:
    image: grafana/grafana:latest
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana-dashboards:/etc/grafana/provisioning/dashboards
      - ./grafana-datasources:/etc/grafana/provisioning/datasources
    ports:
      - "3000:3000"
    depends_on:
      - prometheus
      - elasticsearch

volumes:
  esdata:
  prometheus_data:
  grafana_data: