Tools

anchore/grype

A vulnerability scanner for container images and filesystems

anchore/syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

open-policy-agent/opa

Declarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…

kubescape/kubescape

Open-source Kubernetes security platform scanning clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance against NSA,…

google/gvisor

Sandboxes containers via a userspace application kernel that intercepts system calls, limits host kernel access, and integrates with…

kata-containers/kata-containers

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel…

aquasecurity/kube-bench

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

fairwindsops/polaris

Validation of best practices in your Kubernetes clusters

eshlomo1/cloudsec

Master the art of cloud exploitation. A specialized resource for offensive security researchers and red teamers focused on weaponizing…

stackrox/kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…

falcosecurity/falco

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…

kmkz/exploits

Original CVEs, exploit PoCs, and security advisories with detailed vulnerability chains, privilege escalation, and container escape techniques for…

markakd/container_escape

Container escape proof-of-concept exploits for CVE-2026-80521 and CVE-2026-52910, with a disposable QEMU/Ubuntu VM harness for safe PoC execution.

inguardians/peirates

Peirates - Kubernetes Penetration Testing tool

nestybox/sysbox

An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.

datadog/security-labs-pocs

Proof of concept code for Datadog Security Labs referenced exploits.

secure-system/insular

Isolate your big brother apps https://secure-system.gitlab.io/Insular/