Pilviturvallisuus

- Virtual infrastructure, full virtualization, and the distinction betweenvirtual machines and OS-level containers.• Linux processes and /proc; PID, mount, UTS, IPC, user, cgroup, andnetwork namespaces. - Cgroups v2 for CPU, memory, PID, I/O accounting, and resourcecontrol. - Container root filesystems, chroot, OverlayFS copy-on-write, imagelayers, writable layers, volumes, and bind mounts.• Network namespaces, veth pairs, Linux bridges, routing, NAT,Docker networks, and port publishing. - Docker object lifecycle, Dockerfiles and image builds, containerd,runc, and OCI image/runtime concepts.

- Container threat models, trust boundaries, application compromise,and the distinction between compromise, exposure, lateralmovement, and host escape. - UID/GID identity, root and rootless execution, user namespaces,Linux capabilities, capability sets, and no-new-privileges.• Seccomp syscall filtering; Linux Security Modules; AppArmor andSELinux policy; read-only and masked paths; device restrictions. - Runtime and daemon security, privileged containers, hostnamespace sharing, sensitive mounts, devices, runtime sockets,network exposure, and availability limits. - Image and CI/CD security: Dockerfile design, BuildKit secrets, multi-stage builds, minimal images, tags and digests, scanning, SBOMs,provenance, signatures, and registry trust. - Runtime secret delivery, escape taxonomy, rootless mode, strongerisolation, monitoring, and operational hardening.

- Kubernetes control-plane and node architecture, API server, etcd,controllers, scheduler, kubelet, runtime integration, and componenttrust boundaries. - Pods, workloads, namespaces, resources, Services, volumes, andthe relationship between Kubernetes abstractions and containerisolation. - Kubeconfig identities, ServiceAccounts, projected tokens, RBACroles and bindings, authorization checks, and privilege-escalationpatterns. - Security contexts, workload identity, capabilities, seccomp, Linuxsecurity profiles, Pod Security controls, admission, and workloadhardening. - Cluster networking, service discovery, ingress/egress exposure,NetworkPolicy, tenant boundaries, logging, auditing, and defence indepth.

- Managed-Kubernetes cloud boundary, shared-responsibility layers,and provider-neutral mappings across major cloud platforms. - The separation between Kubernetes RBAC and cloud IAM; control-plane, node, kubelet, and workload identities. - Temporary credentials, instance metadata services, node-roleexposure, and the security impact of node compromise. - Workload identity federation using projected ServiceAccounttokens, trust rules, audiences, subjects, short-lived credentials, andleast-privilege IAM. - Attack paths from a compromised Pod to node or workloadidentities, cloud resources, stronger identities, and persistent impact. - Cloud audit evidence, identity and data-event correlation, andcontrols that break each transition from application to Pod, cluster,node, identity, and resource.