Containerization is a method of packaging an application together with its libraries, configuration, and dependencies into one portable unit, a container, that behaves the same way on a laptop, a test server, or a cloud host. Containers share the host operating system kernel and stay separated from each other using namespaces and control groups, which makes them far lighter than full virtual machines. Docker made the approach mainstream, and Kubernetes became the standard for orchestrating containers at scale.
Security here works in two directions. Isolation limits the blast radius when one app is compromised, but that isolation is thinner than a hypervisor boundary. A container escape flaw can hand an attacker the host, and a single kernel vulnerability exposes every container sharing that kernel. Teams also pull public base images without scanning them, quietly inheriting known vulnerabilities. Image signing, minimal base images, and runtime monitoring address most of this.
Why does containerization matter for the CISSP exam?
Containerization shows up in Domain 8 (Software Development Security), with related coverage in security architecture. Candidates should understand image security, orchestration hardening, and how shared kernels change old assumptions about system boundaries. See Domain 8: Software Development Security for the secure development context.