BellSoft’s 3-in-1 Strategy for Container Security

Containers have made life a lot easier for programmers, making application development portable and solving what cybersecurity firm SentinelOne calls the “it only works in my machine” problem. Given that, it’s not surprising that container adoption among developers continues to grow rapidly. 

But with that popularity comes attention from threat actors looking to exploit container use and the inherent weaknesses in them. NetRise found that two-thirds of organizations in 2024 experienced a container-related security incident, while a Red Hat study said a typical container image carries more than 600 known vulnerabilities, almost half of which are years old.  

In addition, Datadog researchers found that 44% of Java services contain security flaws that have been exploited. 

“The adoption of container technology is rapidly growing, largely because it is lightweight and easy to manage,” NetRise CEO Thomas Pace said late last year. “However, while containers have changed how many modern applications are designed, deployed, and managed, they appear to be among the weakest cybersecurity links in the software supply chain.” 

Hardened Images 

BellSoft is rolling out Hardened Images, a tool for improving the security of containerized applications in Kubernetes by removing package managers and non-essential components, which the company said will reduce vulnerabilities and limit the attack vectors. They also include a locked configuration that can’t be modified, which keeps attackers from injecting malware or tampering with the runtime environment. 

“Our solution addresses seemingly an impossible task,” BellSoft CEO Alex Belokrylov told Cloud Native Now. “From now on, we can provide a foundation that can be trusted and depended on for years.” 

It’s part of a trend by vendors to ensure the security of containers by removing unnecessary elements that can open them up to security threats. For example, Chainguard has a growing list of its own images in a repository that gives developers access to hardened container images that are free of known-exploited vulnerabilities. 

Not a New Problem 

“This isn’t a new problem,” Belokrylov said. “The industry has been addressing it for decades through various approaches: lightweight Linux distributions, distroless images, and now hardened containers. Each represents an evolution in our collective effort to build more secure systems. What’s fundamentally different today is the convergence of three forces that are transforming this from a technical challenge into a strategic solution.” 

Those forces include global regulatory frameworks that require organizations to ensure unprecedented levels and security accountability and a threat landscape being remade by AI. 

“Vulnerability exploitation that once took weeks or months now happens in days or even hours,” the CEO said. “We’re in a time-based competition, and the clock is accelerating.” 

He added that “large enterprises find themselves in an increasingly untenable position: growing codebases, aging legacy systems, and expanding regulatory requirements, all while the threat environment becomes more sophisticated.” 

Security and Performance 

Bellsoft’s Hardened Images are based on what the vendor calls its “3-in-1” approach that delivers complete security and performance coverage via Java runtime optimization, custom maintenance for the vendor’s Alpaquita Linux OS, and proactive remediation of common vulnerabilities and exposures (CVEs). 

The strategy separates BellSoft from a growing field of firms with container security solutions, Belokrylov said. Most of them focus on vulnerability detection and remediation; a solution also needs to be able to fix bugs, which requires deep expertise in the runtime OS and an understanding of how components fundamentally interact, which he said BellSoft has. 

“That kind of expertise makes the difference when you need actual fixes, not just randomly available patches,” he said.  

A Unified Approach 

However, a challenge is that when an urgent fix is needed, the runtime support can come from one vendor and the hardened images from another, which raises such questions as who validates compatibility and who’s accountable if something breaks. BellSoft’s 3-in-1 approach means the vendor provides support for the Liberica JDK runtime and Alpaquita Linux OS. 

“When an issue emerges, there’s no finger-pointing between different vendors, no integration challenges, no question about who owns the solution,” Belokrylov said. “We do. This represents a shift from the fragmented approach that has dominated the market. From now on, there is an integrated solution built on deep runtime expertise, with clear accountability from day one.”