#1Tools for scanning, securing, and hardening Docker, Kubernetes, and containerized environments.
Kitploit recommended
rivet-dev/sandbox-agentA durable process per agent, with memory that survives restarts
skydive-project/skydiveAn open source real-time network topology and protocols analyzer
owasp-dep-scan/dep-scanNext-generation dependency vulnerability scanner with reachability analysis, SBOM generation, license audit, and container image scanning for CI/CD…
controlplaneio/kubesecSecurity risk analysis for Kubernetes resources
siriusscan/siriusOpen-source vulnerability scanner with automated network discovery, CVE-based detection, CVSS scoring, risk dashboards, remote agents via gRPC, and a…
securecodebox/securecodeboxKubernetes-native security scanning orchestrator that automates continuous vulnerability detection by integrating multiple open-source scanners into…
safedep/vetProtect against malicious open source packages 🤖
mongodb/kingfisherDetect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
lxc/incus-osImmutable Linux OS image optimized for running Incus containers and virtual machines, with UEFI Secure Boot, TPM 2.0 disk encryption, and automated…
stealthcopter/deepceDocker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)
mozillazg/ptcpdumpeBPF-based packet analyzer that captures network traffic with automatic process, container, and Kubernetes pod metadata annotation, supporting…
kubeshop/botkubeAn app that helps you monitor your Kubernetes cluster, debug critical deployments & gives recommendations for standard practices
al0ne/linuxcheckLinux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查
trailofbits/claude-code-devcontainerSandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.
kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…
mgeeky/packmypayloadA PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats.…
aquasecurity/starboardSuperseded by https://github.com/aquasecurity/trivy-operator
metarget/metargetMetarget is a framework providing automatic constructions of vulnerable infrastructures.
